New Delhi: A data breach at South Korea’s government-backed startup support platform Modu-ui Changup has highlighted a critical weakness in encryption security: encrypted data can still be exposed if the encryption keys protecting it are not properly secured.
The platform, operated under the oversight of South Korea’s Ministry of SMEs and Startups (MSS), supports a nationwide startup audition programme and stores sensitive participant information, including names, email addresses and summaries of startup ideas.
Authorities later determined that the key used to decrypt protected information had itself been exposed through an application programming interface (API), allowing the encrypted information to be accessed.
Encryption key exposed through API
The incident came to light after concerns were raised about the platform’s handling of applicants’ personal information. The Ministry of SMEs and Startups subsequently announced that personal information and startup idea summaries had been leaked and launched an investigation with the National Intelligence Service, Cyber Security Center and National Police Agency.
On July 31, authorities confirmed that exposure of an encryption key through an API was the decisive cause of the leak.
According to the ministry, the encryption key was included in API data. An external party allegedly collected the information using techniques such as web crawling, thereby obtaining both the protected data and the key required to decrypt it.
Investigators found that information that was not displayed through the platform’s public-facing interface could nevertheless be retrieved through API responses. This reportedly included email addresses that applicants had configured as private.
Algoritha Security Launches ‘Make in India’ Cyber Lab for Educational Institutions
Around 5,000 applicants affected
The exposed information reportedly included email addresses, evaluation comments and summaries of startup ideas belonging to around 5,000 successful applicants.
Authorities identified 39 IP addresses that accessed the leaked information. All of the identified addresses originated in South Korea. Investigators are continuing to examine the incident, including possible links to AI solution providers.
The breach has also raised concerns about the practice of storing encryption keys as fixed values within application code, configuration files, databases or other environments connected to the systems holding encrypted information.
When encryption keys are stored alongside the systems or data they are designed to protect, a compromise of the application or API can potentially expose both the encrypted information and the means to decrypt it.
Why key management is critical
The incident demonstrates that encryption alone cannot guarantee data security. Encryption converts sensitive information into protected form, but anyone who obtains the corresponding key may potentially decrypt that information.
A properly designed security architecture therefore requires encryption keys to be separated from the databases and applications containing the encrypted information.
Security experts recommend storing keys in dedicated Key Management Systems (KMS), with applications requesting access to a key only when required to process protected information. Applications should not retain permanent copies of sensitive encryption keys.
The compromise of an encryption key can also create risks beyond data exposure. Depending on how the system is designed, attackers may potentially use compromised credentials or keys to impersonate legitimate users or access additional parts of an organisation’s infrastructure.
Replacing the key may not be enough
The incident also highlights the difficulty of responding to a compromised encryption key.
Simply revoking the exposed key and generating a replacement may not be sufficient. Organisations may also need to re-encrypt existing information protected by the compromised key and examine key-access logs to determine which data was accessed.
Security teams should additionally reassess permissions across APIs, servers and internal storage systems. Affected individuals may need to be notified, while continuous monitoring should be introduced to detect further unauthorised activity.
A compromised key can therefore force organisations to undertake extensive security reviews and, in some cases, redesign parts of their security architecture.
Government platforms face higher security expectations
The South Korean incident is particularly significant because the affected platform was linked to a government-backed startup programme and contained information related to business ideas and applicants.
The case underlines the need for public institutions and enterprises to treat encryption and key management as separate but interconnected security controls. Protecting encrypted databases without protecting the keys independently can leave sensitive information vulnerable.
The incident also demonstrates the growing importance of reviewing API security. Data that is hidden from a website’s visible interface may still be accessible through improperly configured API endpoints.
For organisations handling sensitive personal, financial or intellectual-property data, secure key storage, strict API access controls, detailed logging, regular security testing and rapid key-rotation procedures are increasingly important components of a broader data-protection strategy.
