In July, **Modu-ui Changup** (모두의창업), South Korea’s government-backed startup support platform, experienced a data breach. The incident revealed a critical failure in encryption key management, demonstrating that even encrypted data can be exposed if the keys are not properly secured. The platform, which supports a nationwide startup audition program overseen by South Korea’s **Ministry of SMEs and Startups (MSS)**, stores sensitive participant information, including startup concepts, email addresses, and names. Concerns about potential data exposure through API responses had been raised a month prior to the reported breach. Although the government claimed immediate action, details on security architecture improvements were not disclosed. On June 18, the **MSS** announced that personal information and summaries of startup ideas had been leaked. A joint investigation was launched with the **National Intelligence Service**, the **Cyber Security Center**, and the **National Police Agency**. Authorities confirmed on July 31 that the primary cause of the leak was the exposure of an encryption key via an API. ## How the Data Breach Occurred The leaked data was encrypted, but encryption keys are essential for decryption. In this incident, the encryption key was exposed alongside the API data, leading to the disclosure of email addresses, evaluation comments, and startup idea summaries for about 5,000 successful applicants. The **MSS** explained that the encryption key was included within the API. An external party collected API data through methods like web crawling, which led to the key's exposure. Even email addresses configured as private were obtainable through AI-based web crawling, despite not being visible on the public-facing interface. This case underscores the risks of hard-coding encryption keys within application code, configuration files, or databases. When keys are embedded in this manner, they can be exposed along with the systems or data they are meant to protect. The fundamental issue was a security architecture that lacked proper encryption key management. Investigations identified 39 IP addresses, all originating from South Korea, involved in accessing the leaked information. Further details, including potential connections to AI solution providers, are still under investigation. When an encryption key is compromised, simply revoking it and issuing a new one is insufficient. Organizations must re-encrypt all data protected by the compromised key, analyze key access logs to determine the full scope of the breach, and reassess access permissions across APIs, servers, and internal storage systems. Notifying affected data subjects and implementing continuous monitoring are also crucial. A compromised encryption key often necessitates a substantial investment in time and resources to redesign the entire security architecture. ## Why Encryption Key Management Matters The **Modu-ui Changup** breach highlights that encryption offers little protection if encryption keys are not securely separated from the data they protect. Without robust encryption key management, encrypted information remains vulnerable. If an encryption key is compromised, attackers can gain real-time access to system data, impersonate legitimate users, and potentially seize control of the system. The efficacy of data encryption is directly tied to the security of its key management. For effective protection, organizations should store encryption keys in a dedicated **Key Management System (KMS)**, physically or logically separated from databases and applications. Applications should only request access to a key from the **KMS** when needed, rather than storing the key themselves. Encryption is vital for regulatory compliance with standards such as **GDPR**, **Cyber Resilience Act (CRA)**, and **HIPAA**. However, poor key management can render encryption ineffective post-compromise, hindering compliance efforts. Organizations aiming to meet global security and compliance requirements should consider specialized cybersecurity solutions, such as those offered by **Penta Security**, a vendor with extensive expertise in encryption and key management. ## D.AMO Key Management: Effective Protection For 30 Years **D.AMO**, **Penta Security’s** data security platform, provides encryption-based data protection, secure key management, and access control, backed by nearly 30 years of cybersecurity experience. **D.AMO** integrates encryption, access control, backup, and recovery across an organization’s entire infrastructure, including on-premises and cloud environments. **Penta Security’s** Data Security Platform has been deployed by over 10,000 customers in finance, government, and the private sector, demonstrating its reliability and technical prowess. **D.AMO** also supports **NIST-standardized post-quantum cryptography (PQC)** algorithms for key management, preparing data security architectures for the quantum computing era. The **D.AMO Key Management System (D.AMO KMS)** physically and logically separates encryption and decryption keys from the data they protect. It manages the entire key lifecycle and performs log integrity checks, enabling quick investigation of key-related activities during security incidents.  Had **D.AMO** been implemented on the South Korean government startup platform, the data breach caused by inadequate encryption key management could have been prevented. Enterprises and public institutions must shift from reactive post-incident responses to proactive prevention. This critically involves protecting sensitive data with both strong encryption and secure, centralized encryption key management.