[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fIc7GxYYDROE0hXivXIWKJPOrvFlFDhbxlueoOTRVTJk":3},{"article":4,"iocs":48,"watch_terms":49,"solutions":50,"lesson":134},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"2dc2c78f-cebb-409e-90ce-bd79319e4c2c","South Korean startup platform breach exposes key management failures","south-korean-startup-platform-breach-exposes-key-management-failures-501a55","A breach at South Korea's government-backed startup platform exposed encrypted personal data after an encryption key was included in an API. Penta Security explains why encryption keys must be securely managed and kept separate from the data they protect. [...]","A data breach at South Korea's government-backed startup platform, Modu-ui Changup, exposed personal data and startup ideas. The incident occurred because an encryption key was improperly included in an API, allowing external parties to decrypt sensitive information through web crawling. This highlights a critical failure in encryption key management.","South Korean startup platform breach exposes encrypted data due to exposed encryption key.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fsouth-korean-startup-platform-breach-exposes-key-management-failures\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fposts\u002F2026\u002F08\u002F21\u002Fpenta-cyber-keys.jpg","2026-08-24T14:00:10+00:00","2026-08-24T16:00:18.887166+00:00",7,[17,20,23],{"name":18,"type":19},"Penta Security","vendor",{"name":21,"type":22},"D.AMO","product",{"name":24,"type":22},"D.AMO DSP","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":25,"icon":27,"name":28,"slug":29},null,"Breaches","breaches",[31,33,38,43],{"category":32},{"id":25,"icon":27,"name":28,"slug":29},{"category":34},{"id":35,"icon":27,"name":36,"slug":37},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":39},{"id":40,"icon":27,"name":41,"slug":42},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":44},{"id":45,"icon":27,"name":46,"slug":47},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[18,21,24],{"controls":51,"vendors":133},[52,81,107],{"slug":53,"name":54,"problem":55,"products":56},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",[57,65,73],{"vendor_slug":58,"vendor_name":59,"vendor_logo":60,"product_slug":61,"product_name":62,"url":63,"description":64},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-secrets-management","Idira Secrets Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fmachine\u002Fsecrets-management","Secrets management for applications, scripts and pipelines, from the former CyberArk portfolio.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"gitguardian","GitGuardian","\u002Fvendor-logos\u002Fgitguardian.png","gitguardian-platform","GitGuardian Secrets Detection","https:\u002F\u002Fwww.gitguardian.com\u002F","Finds and helps remediate secrets leaked in repositories, CI pipelines and chat tools.",{"slug":82,"name":83,"problem":84,"products":85},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",[86,91,99],{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":87,"product_name":88,"url":89,"description":90},"cortex-cloud","Cortex Cloud","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcloud","Cloud security platform covering posture management and runtime protection.",{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"wiz","Wiz","\u002Fvendor-logos\u002Fwiz.png","wiz-cloud","Wiz Cloud","https:\u002F\u002Fwww.wiz.io\u002Fplatform\u002Fwiz-cloud","Agentless cloud security posture and attack path analysis across major cloud providers.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-cloud-security","Falcon Cloud Security","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fcloud-security\u002F","Cloud posture management and workload protection.",{"slug":108,"name":109,"problem":110,"products":111},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",[112,120,125],{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"thales","Thales","\u002Fvendor-logos\u002Fthales.png","ciphertrust","CipherTrust Data Security Platform","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fdata-security-platform","Data discovery, encryption and central key management across on-premises and cloud.",{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":121,"product_name":122,"url":123,"description":124},"luna-hsm","Thales Luna HSM","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fhardware-security-modules","Hardware security modules for protecting cryptographic keys.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",[],{"slug":135,"title":136,"body":137,"framework_refs":138,"framework_notes":148},"encryption-key-exposed-in-api-leads-to-startup-platform-data-breach","Encryption Key Exposed in API Leads to Startup Platform Data Breach","The breach at Modu-ui Changup occurred because a sensitive encryption key was hardcoded or improperly embedded directly within an API, making it accessible to anyone who could crawl or inspect the endpoint. This is a fundamental failure in secrets management — encryption keys must never be stored in code, APIs, or other externally accessible locations. The exposure allowed attackers to decrypt sensitive personal data and proprietary startup ideas, undermining the entire purpose of encryption. This incident demonstrates that encryption is only as strong as the controls protecting the keys themselves, and that even government-backed platforms can suffer from basic security hygiene failures.",[139,140,141,142,143,144,145,146,147],"CIS Control 3.11 – Encrypt Sensitive Data at Rest","CIS Control 4.7 – Manage Default Accounts on Enterprise Assets","NIST SP 800-57 – Recommendation for Key Management","NIST SC-12 – Cryptographic Key Establishment and Management","NIST SC-28 – Protection of Information at Rest","NIST SA-15 – Development Process, Standards, and Tools","OWASP API Security Top 10 – API2: Broken Authentication \u002F API8: Security Misconfiguration","GDPR Article 32 – Security of Processing","ISO\u002FIEC 27001 A.10.1 – Cryptographic Controls",{}]