Encryption Keys Also Leaked in Modeui Changup Successful Applicant Information Incident

Ministry of SMEs and Startups, National Intelligence Service Announce Findings and Response Measures
Encryption Key Also Leaked Alongside Private Data
Recruitment for Second Cohort to Begin After Completing Security Measures by Mid-August

The government’s investigation into the data leak incident involving the ‘Moduui Startup’ (Moduui Changup) startup support platform revealed that the core issue was the simultaneous exposure of confidential information—such as review comments and idea summaries—along with encryption keys, making the information accessible.

The Ministry of SMEs and Startups, the primary authority for Moduui Startup, held a briefing at the Government Complex in Jongno-gu, Seoul, on the 31st and announced the investigation’s findings. The probe was conducted jointly by the Ministry and the National Intelligence Service.

No Yongseok, First Vice Minister of the Ministry of SMEs and Startups, explained, “During the process of API (application programming interface) collection by an external entity, confidential information was included. Although this information was encrypted, the encryption key was also leaked, allowing decryption.” Web crawling refers to the automated use of software to navigate and collect data from websites.

The incident surfaced on June 15 when the profiles of successful applicants were released on the Moduui Startup platform. The leaked data included the email addresses of 5,000 first-round successful applicants, review comments, and summaries of startup ideas of up to 200 characters. According to the investigation, there were 39 domestic internet protocol (IP) addresses that attempted access. This is more than four times the previously announced figure of 9 IP addresses last month.

The Ministry plans to conduct a comprehensive review of the Moduui Startup platform’s API to minimize information exposure and block the transmission of confidential information. Additionally, the Ministry will strengthen personal information encryption systems by introducing new database protection encryption solutions. All API access will be recorded in system logs, and web crawling prevention measures will be further enhanced.

Vice Minister No also announced plans to “work with the National Intelligence Service to conduct security reviews and technical consultations when building new services or making significant function upgrades, as well as to carry out penetration testing and cybersecurity incident response drills. In the event of a security breach, a joint response system will also be in operation.” Furthermore, the Ministry will include ‘startup idea application forms’ in the management scope of personal information—treating these ideas as important as personal data. Access to sensitive information will be strictly limited to authorized personnel, while all other managers will be blocked from viewing such data.

After establishing a reporting center following the data breach, the Ministry received 87 reports from July 18 to the present. These included 50 damage reports, 9 requests for confirmation of data leakage, 11 accountability demands, 8 requests for idea protection, and 9 other cases. The Ministry stated that it has already conducted detailed investigations and informed the parties involved in two cases where allegations of idea theft were reported.

The Ministry intends to complete security reviews by the National Intelligence Service, the impact assessments by the Personal Information Protection Commission, and software influence evaluations by the Ministry of Science and ICT by mid-August. After these are concluded, recruitment for the second round of Moduui Startup will commence.

This content was produced with the assistance of AI translation services.