South Korea's government-backed startup support platform, Modu-ui Changup, experienced a data breach in July that exposed personal information and startup ideas, according to an announcement from the Ministry of SMEs and Startups (MSS). The incident, which affected approximately 5,000 successful applicants, was attributed to a critical encryption key management failure.
Concerns about potential data exposure through API responses had been raised a month prior to the reported breach. On June 18, the MSS confirmed that personal information and summaries of startup ideas had been leaked. A joint investigation was subsequently launched with the National Intelligence Service, the Cyber Security Center, and the National Police Agency.
Authorities confirmed on July 31 that the primary cause of the leak was the exposure of an encryption key via an API. The leaked data, which included email addresses, evaluation comments, and startup idea summaries, was already encrypted. However, the encryption key was included within the API data itself, allowing an external party to collect the API data and the key, likely through web crawling. Investigators noted that even email addresses configured as private could be obtained through AI-based web crawling.
The incident highlights the risks associated with hard-coding encryption keys directly into application code, configuration files, or databases. When keys are stored in the same environment as the data they are meant to protect, they can be exposed alongside the systems or data if a breach occurs. The fundamental issue in this case was a security architecture that lacked proper encryption key management.
Investigators identified 39 IP addresses involved in accessing the leaked information, all originating from South Korea. Further details, including potential connections to AI solution providers, are still under investigation.
When an encryption key is compromised, simply revoking the key and issuing a new one is insufficient. Organizations must re-encrypt all data previously protected by the compromised key, analyze key access logs to determine the full scope of the breach, and reassess access permissions across APIs, servers, and internal storage systems. Affected individuals must also be notified, and continuous monitoring implemented.
The effectiveness of data encryption is directly tied to the security of its key management. For encryption to provide genuine protection, encryption keys should be stored in a dedicated Key Management System (KMS) that is physically or logically separated from databases and applications. Applications should only request access to a key from the KMS when needed, rather than storing the key themselves. This separation helps prevent real-time access to data and system impersonation if a key is compromised.
