South Korean Startup Platform Breach Exposed API Encryption Key
Summary
South Korean authorities said an exposed encryption key in the Modu-ui Changup platform’s API enabled access to personal information and startup-idea summaries for about 5,000 applicants. The sponsored article also recommends separating keys from data.
Key points
- Authorities said an encryption key was included in the platform’s API and exposed alongside API data.
- About 5,000 successful applicants’ email addresses, evaluation comments, and startup-idea summaries were exposed.
- The ministry said an external party collected API data using methods including web crawling; investigators said private email addresses could also be obtained through AI-based crawling.
- Authorities identified 39 IP addresses involved in accessing the exposed information; all originated in South Korea. Investigations were continuing.
- The article’s timeline is inconsistent: it says the breach occurred in July but also says the ministry announced the leak on June 18.
- The article recommends re-encrypting data protected by a compromised key, reviewing key-access logs and permissions, notifying affected people, and monitoring for further activity.
Article Details
- Victim Organization
- Modu-ui Changup (모두의창업), a South Korean government-backed startup support platform
- Incident Type
- Data breach involving an encryption key exposed through an API
- Disclosure Date
- 2026-06-18
- Data Types Exposed
- Email addresses
- Evaluation comments
- Startup idea summaries
- Affected Records
- About 5,000 successful applicants
- Operational Impact
- The reported impact was exposure of applicant data. No operational disruption is described.
- Ransom Or Extortion
- Unknown
- Claim Status
- confirmed