Nearly 40 million user accounts belonging to South Korean streaming platform Tving were compromised in a major data breach linked to a hacking incident reported in June, according to the findings of a joint government and private-sector investigation.
The Ministry of Science and ICT announced the results of its three-month investigation into the breach at Tving, an online streaming service operated by entertainment giant CJ ENM.
Investigators found that 39.54 million user accounts and 361 technical assets, including source code, were compromised in the incident reported on June 1. The ministry noted that the account figure includes multiple accounts belonging to the same individuals.
The affected accounts included 7.26 million accounts registered directly with Tving, 8.63 million CJ ONE integrated membership accounts and 22.47 million accounts created through social media login services such as Naver, Kakao, Facebook, Apple and X.
Of the total accounts, 22.06 million were active and could still be used to log in, while 17.37 million were inactive, including dormant and closed accounts.
The investigation found that the exposed information covered 20 categories and 70 different types of data. This included names, dates of birth, mobile phone numbers, email addresses and connection-related information. The exact information exposed varied depending on how each account was registered.
Investigators determined that an unidentified hacker obtained an access key belonging to a developer and used it to gain entry into Tving’s internal systems.
Tving has since strengthened its security measures, and investigators said they have not found evidence of any additional attacks so far.
The investigation also found that Tving did not report the breach to the Korea Internet and Security Agency within the required 24-hour period after detecting the incident on May 30. The company reported the breach on June 1 and could potentially face a fine because of the delay.
Authorities warned that the stolen information could lead to secondary attacks. Criminals could potentially use the exposed personal data for scams and cybercrimes, including smishing and voice phishing.
The Personal Information Protection Commission is expected to separately assess the extent of the personal information breach and determine any penalties against Tving.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
The incident comes at a difficult time for the streaming service, which had recently begun improving its financial performance. Tving reported 140.7 billion won (US$103.6 million) in sales and 6 billion won in operating profit during the second quarter, marking its first quarterly operating profit since becoming a standalone company in 2020.
