이 포스팅은 쿠팡 파트너스 활동의 일환으로, 이에 따른 일정액의 수수료를 제공받습니다.
Chapter 41: Breach
The alert came at 4:23 AM on a Wednesday in December, and it was the kind of alert that made Dojun’s blood freeze before his brain finished processing the words.
SECURITY INCIDENT — Nova Systems Infrastructure
Unauthorized access detected on Aria Enterprise Cluster 7
Affected accounts: 340+ enterprise clients
Data exposure: Task metadata, email subject lines, calendar titles
Status: INVESTIGATING
He was out of bed and calling Seokho before the alert finished loading.
“I know,” Seokho answered on the first ring. His voice had the flat precision of someone operating in crisis mode—all emotion stripped, pure function. “We detected the breach forty minutes ago. An attacker exploited a vulnerability in our load balancer’s authentication module. They accessed the shared metadata layer between enterprise tenants.”
“How much data?”
“Task metadata only. Not email bodies, not file contents, not user credentials. But task names, email subject lines, and calendar event titles for approximately 340 enterprise accounts.” A pause. “Including Sony.”
Dojun’s stomach dropped. Sony. Three thousand seats. Their anchor client. The contract that had transformed Aria from a startup to a real company. If Sony’s internal task data—case names, contract titles, confidential meeting agendas—had been exposed to an attacker, the consequences would be catastrophic. Not just for Aria, but for Sony’s legal department, which handled billions of dollars in patent litigation.
“Is the breach contained?”
“We isolated the affected cluster at 3:50 AM. The attacker is locked out. But the damage window is approximately six hours—from when the vulnerability was introduced to when we detected the access.” Another pause. “Park. This is my fault. The load balancer vulnerability was in code that I reviewed and approved. I missed it.”
“We’ll assign blame later. Right now, what do we need to do?”
“Three things. One: full forensic analysis to determine exactly what was accessed. Two: notification to all affected clients within 24 hours—Korean data protection law requires it. Three: public disclosure if the breach meets the threshold for mandatory reporting.”
“It meets the threshold.”
“I know.”
Dojun hung up and called Hana.
“Data breach,” he said. “Nova’s infrastructure. 340 enterprise accounts. Sony is affected.”
Silence. Then: “I’m coming to the office. Twenty minutes.”
“Bring coffee. It’s going to be a long day.”
“It’s going to be a long week.”
By 6 AM, the entire Aria leadership team was in the Gangnam office. Dojun, Hana, Minjae, Jiyoung, Taeyoung—plus Seokho, who had driven from Daejeon through the night and arrived with the wild-eyed intensity of a man who had been staring at server logs for four hours straight.
“Forensic findings,” Seokho said, projecting his laptop onto the conference room screen. His hands were steady—whatever he was feeling, it was locked behind the operational firewall he maintained between emotion and action. “The attacker accessed the metadata index for Cluster 7. This index contains task titles, email subject lines, and calendar event names—but not bodies, attachments, or credentials. The access was read-only; no data was modified or deleted.”
“Who was the attacker?” Jiyoung asked.
“We don’t know yet. The attack originated from a proxy chain through three countries. It’s sophisticated—not a script kiddie, not a random probe. Someone targeted Nova’s enterprise infrastructure deliberately.” He paused. “The vulnerability they exploited was a session token replay attack in the load balancer’s authentication handshake. It’s a known class of vulnerability, but the specific implementation flaw was in our custom code.”
“Your custom code,” Dojun said.
“My custom code. I wrote the authentication module six months ago during the enterprise scaling push. I prioritized performance over security review.” His jaw tightened. “I made a mistake.”
“The mistake is made,” Hana said. Her voice was calm—the particular calm of a designer who understood that crisis response was itself a design problem. “What matters now is the response. Dojun—what’s our communication plan?”
“Transparency. Full, immediate, unconditional transparency.” He stood and went to the whiteboard. “We notify every affected client today. Not a form letter—personal calls from Jiyoung and her team to every account manager. We explain what happened, what was exposed, and what we’re doing about it.”
“Sony first,” Jiyoung said.
“Sony first. I’ll call Tanaka myself.”
“The press?” Taeyoung asked.
“We issue a public statement before the press finds out on their own. If they break the story before we disclose, we look like we’re hiding something. If we disclose first, we control the narrative.”
“The narrative being ‘we got hacked,'” Minjae said.
“The narrative being ‘we got hacked, we detected it within hours, we contained it immediately, and we’re telling you about it before anyone asks.’ That’s the narrative of a company that takes security seriously, not a company that got caught.”
“Will that work?” Hana asked.
“It depends on whether our clients trust us more than they fear the breach. And that depends on how we handle the next 48 hours.”
The call to Tanaka was the hardest conversation of Dojun’s second life.
Not because Tanaka was angry—he wasn’t. He was something worse: disappointed. The particular, quiet disappointment of a man who had taken a risk on a small Korean startup and was now watching that risk materialize.
“How many of our staff records were exposed?” Tanaka asked.
“Task metadata only—meeting titles, email subjects, task names. No document contents, no personal data, no client information from the files themselves.” Dojun kept his voice steady. “We understand that even metadata can be sensitive for a legal department. Case names in email subjects could reveal ongoing litigation. We take this extremely seriously.”
“As do we.” A long pause. “Mr. Park. I recommended Aria to my board over three competing solutions. I staked my professional judgment on your product. A data breach—even a limited one—undermines that judgment.”
“I understand.”
“What are you doing to ensure this doesn’t happen again?”
“Three measures. First: Nova Systems is conducting a complete security audit of their infrastructure, supervised by an independent third-party firm. Second: Aria is implementing end-to-end encryption for all metadata—not just task contents, but titles, subjects, and names. Even if an attacker breaches the infrastructure, the metadata will be unreadable without per-tenant decryption keys. Third: I’m personally overseeing the security architecture review.”
“Personally.”
“This isn’t a delegation situation. When our largest client’s data is compromised, the CEO owns the response. Not the CTO, not the security team. Me.”
Another pause. “Send me the incident report and the remediation plan by Friday. I’ll present it to my board. Their reaction will determine whether Sony continues with Aria.”
“You’ll have it by Thursday.”
“One day early. That helps.” A pause that felt like the space between a judge’s deliberation and the verdict. “Mr. Park. I still believe in your product. But belief requires evidence. Show me evidence.”
“I will.”
The next 72 hours were a masterclass in crisis management that Dojun had never needed to learn in his previous life—because in his previous life, this breach hadn’t happened.
That was the terrifying part. Not the breach itself—breaches were solvable, containable, survivable. The terrifying part was that his forty years of future knowledge were, for the first time, completely useless. This event didn’t exist in the original timeline. There was no playbook, no precedent, no “I’ve seen this before” instinct to guide him.
He was, for the first time since waking up in 2006, genuinely flying blind.
And it was, in a strange way, liberating.
Because without the crutch of future knowledge, he had to rely on something else: the team. The people he had spent four and a half years building relationships with, training, trusting, empowering. The web that held.
Seokho worked for 36 straight hours on the security audit—not because anyone asked him to, but because the vulnerability was his and the fix was his responsibility. By hour 30, Dojun found him slumped over his laptop in the conference room and forced him to sleep for four hours. “The code will still be broken when you wake up. But you’ll be less broken.”
Jiyoung called every affected enterprise client—all 340—in two days. By the end, her voice was hoarse, but every client had been personally notified, had their questions answered, and had received a timeline for remediation. Three clients paused their accounts. The other 337 stayed.
Hana redesigned the incident disclosure page—published on Aria’s website, transparent, detailed, and written in language that non-technical people could understand. “If a security disclosure is written in jargon,” she said, “it’s not a disclosure. It’s a cover-up in fancy language.”
Minjae built a real-time dashboard for the remediation progress—visible to all affected clients through their admin portals. Each security measure was tracked with a status indicator: green for complete, yellow for in progress, red for pending. “Transparency isn’t just words,” he said. “It’s data. Show them the fix happening.”
Taeyoung implemented the end-to-end metadata encryption in seventy-two hours—a task that should have taken two weeks, done in three days through a combination of expertise, caffeine, and the particular engineering fury of someone who refused to let a security failure define his product.
And Dojun—who in his previous life would have retreated into code, would have buried himself in the technical response while the human response went unmanaged—did something different.
He made phone calls. Not to investors or board members or the press. To the team. Every team member, individually, in the first 24 hours. Sixty conversations. Some lasted two minutes. Some lasted twenty. Each one said the same thing: “This is serious. We’re handling it. Your job is safe. I need you.”
“You called sixty people individually,” Hana said on Thursday evening, when the worst was over and the office had settled into the exhausted calm that follows a crisis survived. “In the middle of the biggest emergency we’ve ever had, you spent hours on the phone with individual employees.”
“They needed to hear it from me. Not from an email. Not from a Slack message. From me.”
“That’s… not what most CEOs would do.”
“Most CEOs haven’t learned that the team is more important than the crisis. The crisis is temporary. The team is permanent—if you treat them right.”
She looked at him with an expression he had come to know well—the look she gave when she saw something in him that didn’t match his age, his experience, his history. The look that said you’ve been through something I can’t see.
“The mysterious experience again,” she said softly.
“The mysterious experience.”
“Someday.”
“Someday. Soon.”
“You keep saying soon.”
“I mean it more each time.”
The incident report reached Tanaka on Thursday at 5 PM Japanese time—one day early, as promised. It was thirty-two pages of forensic analysis, remediation actions, and architectural improvements, co-signed by Dojun, Seokho, and the independent security firm that had audited Nova’s infrastructure.
Tanaka’s response came on Monday: a formal letter from Sony’s VP of Enterprise Solutions, addressed to the Aria board of directors.
We have reviewed the incident report and remediation plan. While the breach was serious, the response was exemplary. The speed of detection, the transparency of communication, and the comprehensiveness of the security improvements demonstrate a commitment to data protection that we find reassuring.
Sony will continue its partnership with Aria. We view this incident not as a failure but as a test of character—and Aria passed.
Dojun read the letter to the team in the conference room. When he finished, the room was silent for three seconds. Then Minjae stood up and started clapping. Then Taeyoung. Then Soojin. Then everyone—sixty people, standing, applauding, some with tears, some with the particular relief of people who had stared into an abyss and found it staring back, and had not blinked.
“We survived,” Hana said, standing beside him.
“We more than survived. We proved something.”
“What?”
“That the culture holds under pressure. That the people matter more than the product. That when the worst happens, we don’t run or hide or blame—we show up.” He looked at the room—sixty faces, exhausted and triumphant. “This is the company I wanted to build. Not the one that never fails. The one that fails well.”
“Fails well,” she repeated. “That should be a design principle.”
“Add it to the wall.”
She would. The next morning, a fourth line appeared on the design principles sheet in the conference room:
4. Fail well. Then fix fast.
The breach was over. The trust was tested and strengthened. And the company that had been built on a promise—invisible technology, human-first, show up every day—had proven that promises held even when the servers didn’t.