Amicus Lex hack exposes personal data of 20,028 users
A hack at Amicus Lex at 5:38 a.m. on November 11 exposed the names, phone numbers, and email addresses of 20,028 LawForm users. A SQL injection attack targeting the administrator page and a vulnerable API were identified, and the vulnerable API code was deleted. The Ministry of SMEs and Startups disclosed the incident approximately 60 hours after becoming aware of it.
Key facts
- Affected organization
- Amicus Lex
- Incident type
- Data breach
- Occurred / detected
- 2026-11-11
- Scale of damage
- Personal information of 20,028 LawForm users
- Cause / method
- A SQL injection attack on the administrator page and exploitation of a vulnerable API
- Location
- South Korea
If your data was exposed
Exposed dataNamePhone numberEmail
- Don’t tap links in texts, calls or emails that mention this incident and offer compensation, refunds or breach checks. Check directly on the organization’s official website or app.
- If you’ve suffered harm, report it. Call 118 (no area code) for privacy violations, contact the police for financial losses, and apply for dispute mediation to seek compensation.Personal Information Infringement Report Center ↗Korean National Police Agency cybercrime report ↗Personal Information Dispute Mediation Committee ↗
Timeline
- A personal data breach occurred at Amicus Lex at 5:38 a.m.
- The total number of affected LawForm users was confirmed as 20,028, and the SQL injection attack and deletion of vulnerable API code were disclosed.
- Participants in the Modu-ui Changup entrepreneurship program demanded disclosure of the circumstances of the incident and compensation measures.
Also affected by this incident
Hack exposes data of 818 participants in ministry's Entrepreneurship for All program
↳ Knock-on damage from the Amicus Lex incident · View original incident818Impact: Personal information of 818 Entrepreneurship for All participants
The names, phone numbers, and email addresses of 818 participants in the second round of the Ministry of SMEs and Startups' Entrepreneurship for All program were leaked following a hack of AI solution provider Amicus Lex. Amicus Lex detected signs of hacking in its systems on November 11. An SQL injection attack targeting the admin page was confirmed, and the company deleted vulnerable API code, blocked access from overseas IP addresses, and individually notified those affected.
Related reports: 43 · last report →
1 related reports
The summary and key facts are written by AI from related reports and may contain errors. Check the original articles and the organization’s official statements for accurate details.