韩国官方调查称TVING泄露约3954万账户且存在明文密钥等严重安全管理缺陷

About 39.54 million user accounts at online video streaming platform Tving were exposed in a data breach, about twice the roughly 20 million initially estimated by the company in a report to the National Assembly.
The Ministry of Science and ICT (MSIT) announced the results of a public-private joint investigation into the Tving security breach at the Government Complex Seoul on Sept. 3. The investigation found that hackers obtained a total of 39.54 million accounts, including 22.06 million active accounts that could be used to log in, 17.37 million inactive accounts that were dormant or withdrawn, and 110,000 test accounts. Earlier, data submitted by the Personal Information Protection Commission and MSIT to Democratic Party lawmaker Lee Jung-heon of the National Assembly’s Science, ICT, Broadcasting and Communications Committee had put the number affected at about 19.53 million.
The breach also exposed 527,000 user records collected through compensation coupons that KT provided following a personal data leak last year. Those records were excluded from the latest total.
The leaked personal information covered 70 categories, including user IDs, names and dates of birth as well as passwords, refund bank account numbers, connecting information (CI) and duplication information (DI).
Encryption keys for mobile phone numbers and email addresses were also leaked. The investigation team determined that because the data could be decrypted, the exposure was effectively equivalent to a leak of unencrypted information. The Personal Information Protection Commission plans to separately determine the detailed scale of the personal data leak.
The breach also exposed 361 technical assets containing source code, totaling about 30.35 gigabytes (GB). Source code can contain core intellectual property (IP) and authentication information, creating a significant risk that leaked material could be exploited for cyberattacks.
Hackers Attack for Three Days After Stealing Developer Access Key
According to the investigation, the attacker had previously stolen a developer’s access key and used it to gain unauthorized access to the development environment over three days from May 29 to May 31. On May 30, the attacker attempted to exfiltrate information, but Tving detected suspicious activity and blocked the attempt. The following day, however, the attacker created a virtual server, stored 24 GB of user information on it and transferred the data to an external server. The attacker then deleted the virtual server to erase traces of the activity.
Investigators conducted a forensic analysis of the developer’s device to determine how the access key was stolen but were unable to identify the initial attack vector. They also could not identify the original attacker. Police are investigating the incident.
Access Keys Stored in Plaintext, Security Team Had Four Staff
The public-private investigation team said poor management of Tving’s access keys and access privileges, along with an inadequate response system, contributed to the scale of the breach.
Tving was found to have used access keys for its production environment while leaving them exposed directly in source code rather than storing them separately. Environment variables used to configure programs in the development environment were also stored in plaintext instead of being encrypted. Credentials for accessing databases containing user information were similarly stored without encryption.
All developers were granted access to the entire project, while systems for detecting and blocking anomalous activity in real time were also inadequate. A penetration test in 2024 identified a vulnerability involving exposed access keys, but the company failed to address it. Of Tving’s total workforce of 411, only about four employees were dedicated to information security, excluding outsourced personnel.
Tving held a briefing at the Koreana Hotel in Gwanghwamun, Seoul, and apologized for the large-scale security breach. Tving CEO Choi Ju-hee, who attended the briefing, bowed in apology and said, “We accept the investigation findings and will responsibly implement measures to prevent a recurrence and restore customer trust.”
Tving plans to overhaul its security framework by increasing information security investment fourfold and specialized security personnel threefold by 2030. Customer compensation will include insurance coverage against hacking and phishing, 5,000 won worth of Tving points and upgrades to a premium viewing experience.