[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fornSPb675zkuXFL5pq5X5hUgZ9fMOwAKH7iIpOXzPtA":3,"$fNC7oNBuGOmHkplUU_AyYjTYvm9t-P5Bojuulz36HslE":27},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":16,"hero_image_url":17,"structured":18,"story_type":23,"created_at":24,"updated_at":25,"published_at":26},"penta-security-south-korean-startup-platform-returns-encryption-key-in-same-api-","Penta Security: South Korean Startup Platform Returns Encryption Key in Same API Response as Encrypted Data","The decryption key ships in the same JSON response as the ciphertext, making the encryption a no-op for any attacker who gets the response.","A government-backed South Korean startup support platform leaked personal data for startup founders and business owners because its API returned the encryption key alongside the encrypted payload, a finding from Penta Security's analysis.",[10,11,12,13,14,15],"Penta Security","South Korea","API","encryption key","data breach","PIPA","# Penta Security: South Korean Startup Platform Returns Encryption Key in Same API Response as Encrypted Data\n\n*The decryption key ships in the same JSON response as the ciphertext, making the encryption a no-op for any attacker who gets the response.*\n\n**Tags:** `Penta Security` `South Korea` `API` `encryption key` `data breach` `PIPA`\n\n> A government-backed South Korean startup support platform leaked personal data for startup founders and business owners because its API returned the encryption key alongside the encrypted payload, a finding from Penta Security's analysis.\n\n---\n\n## The API returned the key with the data\n\nPenta Security found the encryption key sitting in the same API response as the encrypted data. The response shape was `{ encrypted_data: '...', encryption_key: 'abc123...' }` — the key and the ciphertext travel together in one JSON object.\n\nThis is a textbook case of encryption key mismanagement. There is no cryptographic separation between the key and the data it protects. An attacker who gets one gets both, which means the encryption is effectively a no-op.\n\n## What was exposed\n\nThe exposed data consists of personal identifying information submitted by startup founders and business owners when they applied for government support programs through the platform. The platform is government-backed and serves as the submission layer for South Korea's startup support programs, meaning the data was not just stored but actively transmitted to the government as part of the application flow.\n\nPenta Security confirmed the data includes the standard set of fields for these programs: name, email, phone, and the program-specific identifiers. The data was submitted directly to the platform's API endpoint, which is where the encryption key mismanagement occurred — the same endpoint that returned the key alongside the ciphertext.\n\n## Why the key should never have been there\n\nThe fix is straightforward: the key belongs in an HSM or a dedicated key vault, not in the API response. The endpoint should return `{ encrypted_data: '...' }` and keep the key server-side, where it never travels with the ciphertext. Instead, the platform returned both in one JSON object, so every client that gets the data also gets the key that decrypts it.\n\nThat is the same as taping the combination to the outside of the safe. The data is encrypted, but the key is right there in the response, so the encryption is effectively a no-op for anyone who can read the JSON.\n\n## Key points\n\n- The platform's API response returned both encrypted_data and encryption_key in the same JSON body, so the key and ciphertext travel together.\n- Penta Security's analysis shows the key was included directly in the API response, meaning an attacker with the response can decrypt the data immediately.\n- The exposed data includes personal identifying information submitted by startup founders and business owners for government support programs.\n- The fix is to keep the key in an HSM or KMS and never return it in the same response as the ciphertext.\n- The platform is government-backed, raising PIPA exposure and potential sanctions for the affected users.\n\n## Further reading & sources\n\n- [South Korean Startup Platform Breach Exposes Critical Key Management Failures | CosmicBytez Labs](https:\u002F\u002Flabs.cosmicbytez.ca\u002Fnews\u002F2026-08-24-south-korean-startup-platform-breach-exposes-key-management-failures) — CosmicBytez\n- [Evolution of Ransomware: Multi-Extortion Ransomware Attacks](https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fevolution-of-ransomware-multi-extortion-ransomware-attacks\u002F)","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fpenta-security-south-korean-startup-platform-returns-encryption-key-in-same-api-.png?v=15d19611aa",{"technologies":19},[20],{"vendor":21,"product":22},"South Korean Startup Platform","Startup Support Platform API","breach","2026-09-25T07:03:08.188421+00:00","2026-10-16T12:28:10.443+00:00",null,{"articles":28},[29,40,52,63],{"slug":30,"title":31,"summary":32,"tags":33,"hero_image_url":38,"story_type":23,"created_at":39},"steam-customer-data-exposed-in-ceva-logistics-cyberattack","Steam Customer Data Exposed in CEVA Logistics Cyberattack","CEVA Logistics suffered a cyberattack in July–August 2026 that exposed Steam customer data, with CoinbaseCartel as the likely extortion group behind the breach.",[34,35,36,37,14],"Steam","CEVA Logistics","CoinbaseCartel","cyberattack","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fsteam-customer-data-exposed-in-ceva-logistics-cyberattack.png?v=170450bf47","2026-08-28T12:18:01.176354+00:00",{"slug":41,"title":42,"summary":43,"tags":44,"hero_image_url":50,"story_type":23,"created_at":51},"trezor-confirms-data-breach-at-shipmonk-affecting-14-000-customers","Trezor Confirms Data Breach at ShipMonk Affecting 14,000 Customers","Trezor has confirmed that its third-party shipping partner, ShipMonk, suffered a data breach impacting 14,000 customers after attackers leveraged a SQL injection flaw in the Metabase platform.",[45,46,47,48,49],"Data Breach","ShinyHunters","Trezor","ShipMonk","Metabase","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Ftrezor-confirms-data-breach-at-shipmonk-affecting-14-000-customers.png?v=f8ae5b52ce","2026-08-18T17:57:49.084977+00:00",{"slug":53,"title":54,"summary":55,"tags":56,"hero_image_url":61,"story_type":23,"created_at":62},"exposed-aws-access-key-linked-to-data-breach-affecting-1500-uk-charities","Exposed AWS Access Key Linked to Data Breach Affecting 1500+ UK Charities","CRM provider Beacon attributes a breach impacting around 1,500 UK charities to a compromised AWS access key that was likely exposed during software development, leading to the exfiltration of supporter personal data.",[57,45,58,59,60],"AWS","Charities","Beacon CRM","Credential Exposure","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fexposed-aws-access-key-linked-to-data-breach-affecting-1500-uk-charities.png?v=ec1f5046ce","2026-08-18T14:16:09.055717+00:00",{"slug":64,"title":65,"summary":66,"tags":67,"hero_image_url":72,"story_type":23,"created_at":73},"france-s-dgfip-confirms-breach-after-hacker-zerobytes-claims-600-000-victims","France's DGFiP Confirms Breach After Hacker ZeroBytes Claims 600,000 Victims","French authorities are investigating a breach of the Directorate General of Public Finances (DGFiP) after hacker ZeroBytes claimed to have stolen data on over 600,000 individuals and businesses.",[68,69,70,45,71],"France","DGFiP","ZeroBytes","Government Security","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Ffrance-s-dgfip-confirms-breach-after-hacker-zerobytes-claims-600-000-victims.png?v=fc9efd493d","2026-08-18T08:44:35.455344+00:00"]