A breach at South Korea’s government-backed startup support platform Modu-ui Changup exposed a basic but costly security failure: encrypted data was paired with the key needed to read it. According to BleepingComputer, authorities later determined that an encryption key had been exposed through an application programming interface, or API, undercutting the protection that encryption was supposed to provide. The platform supports a nationwide startup audition program overseen by South Korea’s Ministry of SMEs and Startups, according to the report. It stored participant information including names, email addresses and summaries of startup ideas — the kind of data that is sensitive both personally and commercially for applicants. BleepingComputer reports that the ministry announced on June 18 that personal information and startup-idea summaries had leaked. The ministry then opened a detailed investigation with the National Intelligence Service, the Cyber Security Center and the National Police Agency. On July 31, authorities confirmed that the decisive cause was the exposure of an encryption key through an API. The data had been encrypted, but that did not prevent disclosure because the key was exposed alongside API data, according to the report. BleepingComputer says the incident affected about 5,000 successful applicants and exposed email addresses, evaluation comments and startup-idea summaries. The ministry said an external party collected API data through methods including web crawling. One notable detail is that some email addresses were configured as private and were not shown on the public interface. Investigators nevertheless concluded that they could be obtained through AI-based web crawling, BleepingComputer reports. The supplied account does not establish who operated the crawling systems or whether any AI solution provider was involved; it says authorities were still investigating possible connections. The incident is a reminder that encryption is not a complete control if key management is weak. BleepingComputer’s account, drawing on Penta Security’s explanation, points to the risk of embedding encryption keys as fixed values in application code, configuration files, databases or similar environments. If those systems are exposed, the key can leak with the protected data. Authorities identified 39 IP addresses involved in accessing the leaked information, all originating in South Korea, according to BleepingComputer. The investigation was continuing into further details, including possible connections to AI solution providers. For operators, the lesson is mechanical rather than theoretical: encryption keys must be managed separately from the data and interfaces they protect. Once a key is exposed, rotating it is not enough; BleepingComputer’s account says organizations also need to re-encrypt data protected by the compromised key and review key-access logs to understand the breach scope. Who benefits: Security teams and platform operators get a concrete case study for tightening API access controls and separating key storage from application data. Key-management vendors and security auditors may also see stronger demand for reviews of government-backed and applicant-facing platforms. Who's exposed: Organizations that hard-code encryption keys or include them in API-accessible environments are exposed. Applicant platforms are especially sensitive because they often combine personal identifiers with proprietary business ideas or evaluation data.