It has been confirmed that user information for 39.54 million accounts, along with 361 development projects containing source code, was leaked externally from the online video service (OTT) platform TVING. The Ministry of Science and ICT (headed by Deputy Prime Minister and Minister of Science and ICT Bae Kyung-hoon) announced these findings from the government-private joint investigation team on the TVING intrusion incident on September 3.
 [코리안투데이] Announcement of the investigation findings on the TVING intrusion incident © 장형임 기자 |
On September 3, the Ministry of Science and ICT released the findings of the government-private joint investigation team (hereinafter the investigation team) into the TVING intrusion incident, disclosing the cause of the breach, the scale of the damage, and measures to prevent a recurrence.
The incident came to light on May 30 when an excessive workload on TVING’s database (DB) server caused a system overload. While analyzing the anomaly, TVING discovered that an unauthorized party had accessed its internal servers without permission and queried user information, and it reported the intrusion to the Korea Internet & Security Agency (KISA, headed by Lee Sang-jung) on June 1. The Ministry of Science and ICT launched an on-site investigation together with KISA on June 2, and after deliberation by the intrusion incident review committee on June 3, it formed the government-private joint investigation team.
The investigation team set the scope of its inquiry to cover how the access key was stolen, the attacker’s intrusion route, the scale of the information leak, and the company-wide information security management system. To this end, it conducted forensic analysis of nine developer devices (eight laptops and one PC) and carried out a correlated analysis of security equipment, DB, and system logs. The data examined amounted to roughly 3.5TB of DB held from March 2011 to May 2026 and about 5TB of security equipment logs.
Damage occurred on both the technical-asset and user-information fronts. In terms of technical assets, 361 development projects containing source code (30.35GB) were leaked. These included core technologies necessary for operating TVING, such as customized content recommendation and search algorithms, user management and authentication systems, payment management, and paid-service operations. The investigation team judged that an attacker could analyze these to identify vulnerabilities and exploit them in a secondary attack, but no signs of any additional attack have been confirmed to date.
The scale of the user-information leak was even larger. Including duplicates, 39.54 million accounts were leaked: 22.06 million active accounts capable of logging in, 17.37 million inactive accounts (comprising 8.5 million dormant and 8.87 million withdrawn accounts), and 110,000 test accounts. Because TVING’s structure allows a single person to hold multiple accounts, one user was found to have held as many as 13 accounts. By sign-up method, there were 7.26 million self-registered accounts, 8.63 million CJ ONE integrated-membership accounts, and 22.47 million accounts created via simple social sign-up such as Naver, Kakao, Facebook, and Apple.
The leaked items numbered 20 categories (70 types), including user ID, one-way encrypted password, name, mobile phone number, email address, date of birth, and connecting information (CI). Passwords were one-way encrypted and cannot be decrypted into plaintext, but mobile phone numbers and email addresses—even where partially encrypted—were exposed at a level equivalent to plaintext because the encryption keys were leaked alongside them. Of the 19.04 million accounts holding a CI, which is generated during identity verification, an average of 11.1 items were leaked, while for the 20.4 million accounts without a CI, an average of 4.6 items were leaked. However, much of the data for the accounts without a CI had inaccurate or missing names or contact details. The precise scale of the personal-data leak will be finalized by the Personal Information Protection Commission after detailed analysis.
The breach originated from the theft of an access key held by a developer. The attacker had stolen a developer’s ‘development-environment access key’ in advance, used it to access the development environment without authorization, and then extracted all 361 development projects. Next, the attacker exploited 2 of the 43 ‘operational-environment access keys’ that had been hard-coded into the source code or left exposed in plaintext to infiltrate the cloud-based operational environment (AWS). During the first extraction attempt on May 30, the DB server’s CPU usage spiked to 100%, triggering an anomaly alert that blocked the attempt; but in the second attempt on May 31, the attacker kept CPU usage within 10% while creating a virtual server, extracted 24GB of user information externally, and then erased the traces.
The investigation team identified structural problems throughout TVING’s information security management system. Access keys were exposed directly in source code or shared indiscriminately over internal messengers, and because every developer was granted access to all projects, the theft of a single key could compromise everything. There was no system to detect and block abnormal activity in real time, and against a workforce of 265 employees and 149 developers, the dedicated information-security staff numbered only around four. In particular, although a hard-coded access-key vulnerability had been found during a 2024 penetration test, no action was taken, and access logs for a new security device (VPN) were retained for only six days.
For users, this means their personal data could at any time lead to secondary harm such as smishing and voice phishing, or to illegal trade on the dark web. TVING has operated a dedicated victim-support call center since June 3, and the investigation team, together with a public security notice, has strengthened real-time monitoring of the dark web and hacking forums. No cases of user harm or signs of illegal distribution have been confirmed to date.
TVING failed to meet the obligation under the Information and Communications Network Act to report an intrusion within 24 hours of becoming aware of it. The investigation team judged the point of awareness to be 10:10 a.m. on May 31, when the situation was relayed to the information security team, but the actual report was made at 3:08 p.m. on June 1—more than 24 hours later—making the company subject to a fine of up to 30 million won.
As recurrence-prevention measures, the investigation team proposed establishing key-management and access-control systems, strengthening the detection of abnormal activity and the monitoring of bulk-data queries, securing sufficient information-security personnel and budget, establishing log-retention management policies, and reinforcing vulnerability remediation. The Ministry of Science and ICT plans to receive an implementation plan from TVING during September, review compliance from October through December, and, starting in January next year, verify implementation status and order corrective action under the Information and Communications Network Act for any inadequate areas.
Government-level follow-up measures are also under way. The revised Personal Information Protection Act, which takes effect on the 11th of this month, allows punitive fines of up to 10% of total revenue in cases of repeated, intentional, or grossly negligent large-scale leaks. The revised Information and Communications Network Act, effective October 1, makes it mandatory for companies to expand their information-security personnel and budgets, provides grounds for the government to launch an investigation even before a report is filed, and newly establishes enforcement fines for companies that fail to faithfully implement recurrence-prevention measures.
지역 홍보대사 신청 기자양성과정 신청 코리안투데이 지부장 신청 코리안투데이 인천강화코리안브랜드대상 신청 최고경영인대상 신청 소비자만족도대상 신청
<저작권자 ⓒ 코리안투데이(The Korean Today) 무단전재 및 재배포 금지>
