South Korea’s government-backed startup support platform, “Everyone’s Startup,” suffered a data breach that exposed sensitive information belonging to about 5,000 successful applicants. The platform is operated under the Ministry of SMEs and Startups and is used for a nationwide startup support program. The leaked information included applicants’ email addresses, review comments, and summaries of their startup ideas.
The incident became known in June 2026, and South Korean authorities began investigating how the information had been exposed. The investigation involved the Ministry of SMEs and Startups, the National Intelligence Service, and other relevant authorities. On July 31, officials confirmed that the main cause was an exposed encryption key connected to an API used by the platform. The incident showed that encrypting data is not enough if the key protecting that data is also exposed.
According to the investigation, some API responses contained information that should have remained private. External parties were able to collect the API data through methods including web crawling. The data itself had been encrypted, but the encryption key needed to decrypt it was also included in the API. This meant that anyone who obtained both the encrypted information and the key could potentially read the protected data.
The exposed information affected around 5,000 successful applicants and included their email addresses, evaluation comments, and startup idea summaries of up to 200 characters. Authorities identified 39 South Korean IP addresses that attempted to access the affected information. Officials said they had not found evidence of additional information being leaked, while investigations by the police and the Personal Information Protection Commission were still continuing.
The incident also highlighted a basic but serious problem in the platform’s security design. Encryption keys are supposed to be protected separately from the information they are used to secure. Instead, the investigation found that the key was exposed through the API, meaning the protection provided by encryption could be defeated. This is why proper key management is considered just as important as encryption itself when protecting sensitive information.
Following the breach, the Ministry of SMEs and Startups said it would strengthen the platform’s security before opening the second round of the program. The ministry planned to review the API, reduce the information provided through it, remove unnecessary functions, strengthen encryption, and improve systems for detecting and blocking abnormal access. It also planned to record API access through system logs and improve protection against web-crawling attempts.
The government also introduced measures to help affected applicants protect their startup ideas. Support was provided for services such as trade-secret certification and technology escrow. The ministry said information-management rules would also be improved, including treating submitted startup ideas as important information requiring stronger protection. As of July 31, 87 reports had been received through the damage-reporting center, covering complaints, requests for information, responsibility claims, and requests for idea protection.
The breach is an important reminder for organizations handling sensitive data that security cannot depend on encryption alone. Encryption keys must be properly separated, controlled, monitored, and protected throughout their lifecycle. The South Korean incident shows how a simple weakness in API design and key management can undermine otherwise encrypted data and expose information that users expected to remain private.
Stay alert, and keep your security measures updated!
Source: Follow cybersecurity88 on X and LinkedIn for the latest cybersecurity news
