Nearly 40 mln Tving accounts compromised in massive data breach: probe

Nearly 40 million user accounts from South Korean streaming platform Tving were compromised in a significant data breach, according to a three-month investigation jointly conducted by the Ministry of Science and ICT and civilian stakeholders. The breach, which was initially reported on June 1, exposed the personal information of 39.54 million accounts, including names, dates of birth, mobile phone numbers, email addresses and various other data points.

This figure encompasses multiple accounts belonging to the same users. Tving, which is operated by entertainment giant CJ ENM Co., has since bolstered its security measures, and no further attacks have been detected. The compromised accounts originated from various registration methods, including 7.26 million directly registered with Tving, 8.63 million CJ ONE integrated membership accounts, and 22.47 million accounts created through social media log-in services like Naver, Kakao, Facebook, Apple, and X. Of the total, 22.06 million accounts were active and usable, while 17.37 million were inactive, including dormant and closed accounts.

The leaked data encompassed 20 categories of information, with the extent varying based on the registration method. Despite the investigation, Tving reportedly failed to inform the Korea Internet & Security Agency of the breach within the mandated 24-hour window, potentially exposing the company to fines. The Personal Information Protection Commission will conduct a separate assessment to determine the full extent of the personal data breach and determine any penalties.

Investigators warned that the hacker could exploit the stolen data for further attacks, and the leaked personal information could be used for cybercrimes like smishing and voice phishing. The breach could negatively impact Tving's financial performance, as the platform posted 140.7 billion won in sales and 6 billion won in operating profit during the second quarter, marking its first quarterly profit since becoming a standalone company in 2020.