Full Report
A breach at South Korea's government-backed startup platform exposed encrypted personal data after an encryption key was included in an API. Penta Security explains why encryption keys must be securely managed and kept separate from the data they protect. [...]
Analysis Summary
# Incident Report: Modu-ui Changup Data Breach & Key Management Failure
## Executive Summary
The South Korean government-backed startup platform, Modu-ui Changup, suffered a significant data breach involving the exposure of approximately 5,000 applicants' personal data. Although the data was encrypted, the incident was exacerbated by a critical architectural failure where the encryption key was included within API responses. This allowed external actors to crawl the API, obtain the key, and decrypt sensitive startup ideas and personal information.
## Incident Details
- **Discovery Date:** June 18, 2026 (Initial announcement of leak)
- **Incident Date:** July 2026 (Confirmed cause identified July 31)
- **Affected Organization:** Modu-ui Changup (모두의창업) / Ministry of SMEs and Startups (MSS)
- **Sector:** Government / Startup Support
- **Geography:** South Korea
## Timeline of Events
### Initial Access
- **Date/Time:** May/June 2026 (Ongoing prior to reporting)
- **Vector:** Web Crawling / API Exploitation
- **Details:** External parties used AI-based web crawling to collect API data. Due to poor security architecture, the encryption key was included in the API response metadata or payload.
### Lateral Movement
- **Details:** Not applicable in the traditional sense; attackers leveraged public-facing APIs to systematically access backend-stored data that should have remained private.
### Data Exfiltration/Impact
- **Details:** Decryption and theft of names, email addresses, evaluation comments, and summaries of startup ideas for approximately 5,000 successful applicants.
### Detection & Response
- **How it was discovered:** Concerns were raised regarding structured data exposure in June; subsequent investigation by the MSS, National Intelligence Service (NIS), and National Police Agency confirmed the breach.
- **Response actions taken:** Launch of a multi-agency forensic investigation; identification of 39 involved IP addresses; platform security review.
## Attack Methodology
- **Initial Access:** API Data Collection (Web Crawling)
- **Persistence:** N/A (Data was harvested via external requests)
- **Defense Evasion:** Use of multiple IP addresses (39 identified) to bypass simple rate limiting or geo-blocking.
- **Credential Access:** Key Exposure; the encryption key was hard-coded or included as a fixed value in API responses.
- **Discovery:** AI-based crawling used to find and structure "private" fields (like email addresses) not visible on the GUI.
- **Collection:** Automated harvesting of API responses.
- **Impact:** Unauthorized decryption of sensitive government-held intellectual property and PII.
## Impact Assessment
- **Financial:** Undisclosed; potential long-term costs for security architecture redesign.
- **Data Breach:** ~5,000 records containing PII and startup intellectual property.
- **Operational:** Disruption to the national startup audition program and necessitated a complete overhaul of the platform's cryptographic infrastructure.
- **Reputational:** High; involves government-backed platforms and sensitive "startup ideas" which are critical to the participants' competitive advantage.
## Indicators of Compromise
- **Network indicators:** 39 South Korean-based IP addresses (specific IPs not disclosed in the report - defang all identified IPs in local logs).
- **Behavioral indicators:** Unusual volumes of API requests mimicking web crawler patterns; requests targeting non-public API fields.
## Response Actions
- **Containment:** Revocation of compromised encryption keys.
- **Eradication:** Investigation into AI solution providers potentially linked to the crawling.
- **Recovery:** Analysis of key access logs to determine the full scope of decrypted data; notification of affected data subjects.
## Lessons Learned
- **Key Separation:** Encryption is ineffective if the key is stored or transmitted alongside the data it protects.
- **Hard-coding Risks:** Hard-coding keys in application code or API configurations creates a single point of failure.
- **API Visibility:** Data "hidden" from the UI is still accessible if the underlying API response remains over-privileged.
## Recommendations
- **Implement a Dedicated KMS:** Move encryption keys to a dedicated Key Management System (KMS) logically separated from the application and database layers.
- **Zero Trust API Design:** Ensure APIs only return the minimum data required for the UI to function (apply "Least Privilege" to data transfer objects).
- **Rotate and Re-encrypt:** Following a key compromise, all historical data must be re-encrypted with a new, securely stored key.
- **Enhanced Monitoring:** Implement rate limiting and behavioral analysis to detect and block AI-driven scraping and crawling attempts.