About 5,000 successful applicants had email addresses, evaluation comments, and startup idea summaries disclosed after an encryption key embedded in an API was collected by external crawlers.
How the breach unfolded on Modu-ui Changup
In July, South Korea’s government-backed startup support platform Modu-ui Changup (모두의창업) suffered a data breach that ultimately exposed personal information and summaries of startup ideas. The platform, which supports a nationwide startup audition program overseen by the Ministry of SMEs and Startups (MSS), stores participants’ personal information including startup ideas, email addresses, and names.
The ministry announced on June 18 that personal information and idea summaries had been leaked and immediately launched a detailed investigation with the National Intelligence Service, the Cyber Security Center, and the National Police Agency. Authorities later confirmed on July 31 that the decisive cause of the leak was the exposure of an encryption key through an API.
Why an encrypted database still leaked
The breached records had been stored in encrypted form. Encryption, however, requires a key to decrypt data. According to the ministry, an encryption key had been included within the platform’s API responses; an external party collected API data—via methods such as web crawling—and the key was exposed together with that data.
When the API response included the key, encrypted fields became usable to an attacker. Investigators said email addresses that had been configured as private and not visible on the public-facing interface could still be obtained through AI-based web crawling that collected API data. The incident highlights a specific fault pattern cited in the investigation: hard-coding encryption keys as fixed values within application code, configuration files, databases, or similar environments can allow keys to be exposed alongside the systems they are intended to protect.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildWhat authorities found and what remains under investigation
Authorities identified 39 IP addresses involved in accessing the leaked information; the ministry said all of them originated in South Korea. The joint investigation by the ministry, the National Intelligence Service, the Cyber Security Center, and the National Police Agency is continuing, including probes into possible connections to AI solution providers.
Officials and investigators emphasized that simply revoking a compromised key and issuing a new one is insufficient. The ministry and its partners said organizations must re-encrypt all existing data protected by the compromised key, analyze key access logs to determine the scope of exposure, reassess access permissions across APIs, servers, and storage, notify affected data subjects, and implement continuous monitoring. They also noted that redesigning security architecture can require substantial time and resources once a key is compromised.
Penta Security and the key-management argument
The report that first published these findings was sponsored and written by Penta Security. The company framed the incident as a demonstration of “how encrypted data can still become exposed when organizations fail to protect encryption keys properly.” Penta Security promoted its D.AMO data security platform and its D.AMO Key Management System (D.AMO KMS) as solutions that physically and logically separate keys from the data they protect, manage the entire key lifecycle, and provide log integrity checks.
Penta Security also stated that D.AMO supports integrated encryption, key management, access control, backup, and recovery across on-premises and cloud environments; that its platform has been deployed by more than 10,000 customers across finance, government, and private sector organizations; and that it can apply NIST-standardized post-quantum cryptography algorithms to key management. The vendor concluded that, had D.AMO been implemented on the platform, “the data breach caused by inadequate encryption key management could have been prevented.”
What this means for technologists, policymakers, and affected applicants
- Technologists and security teams: The incident reinforces actions cited by the ministry and vendors alike—move keys out of application code and responses, use a dedicated Key Management System (KMS) that is physically or logically separated from databases and apps, and require applications to request keys only when needed. Investigators emphasized re-encryption of data after key compromise and log analysis to determine exposure.
- Policymakers and regulators: The ministry’s public statements tied encryption and key management to regulatory compliance, noting encryption’s role in meeting standards such as the GDPR, Cyber Resilience Act (CRA), and HIPAA. The case underlines that compliance frameworks assume not only encryption but sound key management practices.
- Affected applicants and the public: Approximately 5,000 successful applicants had email addresses, evaluation comments, and summaries of startup ideas disclosed. Authorities told investigators to notify affected data subjects and pursue continuous monitoring of exposed systems—steps the ministry said are part of the response.
The breach on Modu-ui Changup is a narrowly described technical failure with a wide operational cost: when keys leak, encrypted records become plain text, and recovery is repeatedly costly and time-consuming. Investigators have traced activity to 39 domestic IP addresses and are still probing links to AI solution providers; until that work concludes, the full chain of collection and intent remains an open question for the agencies involved.
Source: BleepingComputer — South Korean startup platform breach exposes key management failures
