Tving 国会审计承认数据泄露或涉 AI 攻击且安全投入不足，监管拟年内处罚但未披露金额

Choi Joo-hee, chief executive of South Korean streaming platform Tving, said artificial intelligence may have been used in a large-scale breach of customer personal data.
At a parliamentary audit by the National Assembly's National Policy Committee on the 13th, Choi was asked by Cho Jung-hoon, a lawmaker of the People Power Party, whether the Tving hack was also an AI-based attack. "That is what we presume," she said.
On the cause of the breach, Choi bowed her head and said: "We have invested continuously in security, but as the CEO, I am ashamed to say that I do not think I made it enough of a priority to know whether that investment was at a sufficient level." She added that "it has not yet been determined how the hacker first broke in," explaining that the National Police Agency is investigating the initial point of intrusion.
The Personal Information Protection Commission, the agency with jurisdiction over the case, plans to complete its disciplinary action over the Tving breach this year.
When Kim Hyun-jung, a lawmaker of the Democratic Party of Korea, said the company should not have its fine reduced on the basis of an inadequate compensation plan, PIPC Chairperson Song Kyoung-hee said: "Because the commission is a collegial body, the decision will be made after deliberation by multiple commissioners. But if the compensation is not meaningful, it appears unlikely that a fine would be reduced simply because damages were paid."
Song added: "If we give no consideration at all to compensation on the grounds that it is small, other companies may have less incentive to compensate victims when similar incidents occur in the future. We will examine the matter thoroughly, taking that into account as well."
Gangnam Unni, a beauty and medical platform from which large volumes of cosmetic and medical information were leaked, also acknowledged that its security investment had fallen short of its growth. Hong Seung-il, CEO of Healing Paper, which operates Gangnam Unni, said: "I think there were areas where our investment in dedicated personnel and security solutions did not reach a level commensurate with the company's growth and the increase in service users."
The leak of personal data belonging to victims of digital sex crimes by Google was also taken up as a major issue. Yoon Gu, head of Google Korea, said of how the company leaked such data to an external research database: "Normal procedure is that such information should never be shared, but some information was leaked due to human error by an employee." He said the company would investigate the matter.
Asked about plans to notify individual victims and to provide support and compensation, he said the matter was "still under internal review." He did not answer questions on specific figures, including the number of additional deletion requests and the progress of a full review.