South Korea's Ministry of Science and ICT closed out a three-month public-private joint investigation on September 3, 2026, confirming that an unidentified attacker stole a Tving developer's access key, walked into the streaming platform's internal environment, and exfiltrated data tied to 39.54 million user accounts along with 361 technical assets including source code. Tving, operated by entertainment conglomerate CJ ENM, reported the incident to the Korea Internet & Security Agency (KISA) on June 1. Lim Jeong-gyu, director general for information security and network policy at the ministry, delivered the findings at the Government Complex Seoul the same day CEO Choi Ju-hee (rendered as Julie Choi in some Korean-language coverage) bowed in a public apology at the Koreana Hotel in Jung District.
The account figure is not a headcount. Every source that carries the ministry's numbers stresses that one person can hold multiple Tving accounts, and MK reports investigators found at least one individual holding 13. Coverage of the affected-persons figure varies: MK's earlier culture-desk report frames the incident as affecting 19.53 million people, while CHOSUNBIZ on August 31 put the estimate at "about 19.8 million" users. Neither number carries the ministry's stamp the way the 39.54 million account total does, and the Personal Information Protection Commission (PIPC) is expected to separately determine the true scope of personal data exposure.
What Happened
The timeline reconstructed by the joint investigation team, as reported by MK, begins before the public disclosure. On May 30, Tving experienced an overload on a database server. While analyzing the anomaly, the company confirmed that an unauthorized party had accessed an internal server and queried user information. Tving reported the intrusion to KISA on June 1. The Ministry of Science and ICT opened an on-site investigation on June 2 and stood up a public-private joint investigation team on June 3.
Three months later, the ministry published its conclusions. The root cause was access key management. According to the ministry findings as reported by MK and Cineplay, the developer access key was left stored without separate protection and in unencrypted form. Cineplay reports the encryption key was also broken down or compromised, and that a prior simulated-hacking assessment had flagged exposed plaintext access keys before the breach occurred. MK further reports the investigation found Tving's detection capability inadequate and its security function thinly staffed, with four people responsible for information protection at the company.
Cineplay reports that Tving faces a fine of up to 30 million won over delayed reporting of the incident. That figure appears in a single OTHER-tier source and should be treated as unconfirmed pending the ministry's and PIPC's formal enforcement outcomes. The larger financial exposure sits with the PIPC, which has yet to rule on penalties for the personal data breach itself.
The ministry stated that Tving has since strengthened its security measures and that no signs of additional attacks have been detected.
What Was Taken
Two categories of loss are confirmed by the ministry: user account data and technical assets.
On the account side, the 39.54 million total breaks down by registration path as 7.26 million accounts registered directly with Tving, 8.63 million CJ ONE integrated membership accounts, and 22.47 million accounts created through social login providers including Naver, Kakao, Facebook, Apple and X. By status, 22.06 million were active accounts capable of logging in and 17.37 million were inactive, covering dormant and closed accounts. MK and Cineplay add a third bucket the wire coverage omits: approximately 110,000 test accounts, which reconciles the split to the 39.54 million headline.
The exposed data spans 20 categories comprising 70 distinct data types. Confirmed fields include names, dates of birth, mobile phone numbers, email addresses, and connecting information (CI). CHOSUNBIZ and MK also list user IDs and duplicate-subscriber identifiers among the leaked fields. Critically, the ministry noted that the type and extent of information exposed varied by how a user registered, so social-login accounts and direct-registration accounts do not carry identical exposure. No source in this set indicates payment card data or passwords in plaintext were part of the loss, and no source rules it out either.
The technical asset loss is arguably the more consequential half. The ministry confirmed 361 technical assets were compromised, described by MK as development projects containing source code. Cineplay characterizes the exposure as effectively total, quoting Lim to the effect that in practice every account was hit.
Why It Matters
The Korean CI (connecting information) value is the detail defenders outside Korea tend to underweight. CI is a resident-registration-derived identifier used to link a single real person across unrelated services without exchanging the underlying national ID number. A CI paired with a name, birth date, and mobile number is a durable cross-platform correlation key, and unlike a password it cannot be rotated by the user. That makes this dataset useful for identity linkage and targeted social engineering long after the coupons expire.
The social-login majority matters too. More than half the compromised accounts, 22.47 million, were created through Naver, Kakao, Facebook, Apple, or X. Federated identity moves credential risk off the relying party, which is genuinely good, but it does not move the profile data the relying party stores about that identity. Organizations that assume "we use OAuth, so we don't hold sensitive identity data" should read this breakdown carefully.
The source code loss compounds forward risk. Three hundred sixty-one development projects in an attacker's hands means secrets, internal API structure, authentication logic, and any additional hardcoded keys are now available for offline study. The ministry's statement that no further attacks have been detected is a point-in-time observation, not a durable assurance, given what the attacker walked away with.
Finally, this is a case study in a warning that was issued and not actioned. Cineplay reports a simulated-hacking exercise had already identified plaintext access keys. A finding that sits open in a report is functionally identical to a finding that was never made.
The Attack Technique
Per the ministry's confirmed findings, an unidentified attacker obtained a Tving developer's access key to the development environment and used it to reach internal systems, where user information was queried directly from a database server. No threat actor has been named or attributed by the ministry, and no ransomware, extortion demand, or public leak-site posting appears in any of the eight sources reviewed.
The enabling conditions, as reported by MK and Cineplay from the ministry briefing, were a static long-lived credential stored unencrypted and outside any dedicated secrets store, an encryption key that did not survive as an independent control, and detection tooling that surfaced the compromise only indirectly, through a database server overload on May 30 rather than through alerting on anomalous credential use. This is the standard shape of a modern cloud-era intrusion: no exploit, no malware, just a valid key used the way keys are meant to be used, against an environment that could not tell a legitimate developer from an attacker holding the same string.
What Organizations Should Do
-
Inventory every long-lived access key and set a hard expiry. Enumerate static credentials across source repositories, CI/CD configuration, developer workstations, container images, and infrastructure-as-code. Replace them with short-lived, workload-identity-bound tokens. Any key that cannot be rotated in under an hour is an incident waiting for a date.
-
Move secrets into a dedicated store and treat plaintext storage as a Sev-1. The ministry's finding here is that the key sat unencrypted and unmanaged. A vault or cloud secret manager with audit logging and automated rotation removes the entire failure mode, and encryption keys must be held under separate custody from the data they protect.
-
Alert on credential behavior, not just credential validity. Baseline each developer key by source ASN, geography, time of day, API call mix, and query volume. Bulk reads against user tables should page a human regardless of whether the calling credential is valid. Detecting an intrusion via database load is detecting it far too late.
-
Segment production data away from development identity. A development-environment access key should not be able to reach production user records. Enforce separate identity boundaries, separate networks, and separate data planes between environments.
-
Close simulated-hacking and pentest findings on a tracked clock. Assign every finding an owner, a severity-linked deadline, and executive visibility on overdue items. Tving reportedly held a report naming this exact weakness. Track remediation the way you track uptime.
-
Delete dormant data on a schedule. Of the compromised accounts, 17.37 million were inactive, dormant, or closed, and roughly 110,000 were test accounts. Data retained past its business purpose is pure liability. Purge closed accounts on a defined timetable and never seed test environments with real personal data.
-
Right-size the security function to the data footprint. MK reports Tving ran information protection with four staff against a platform holding tens of millions of identity records. Tving's own remediation plan concedes the point: it has committed to roughly four times its prior five-year security investment by 2030, triple the current security headcount, a zero-trust rebuild, stronger security governance, and external expert verification.
For affected users, Tving is offering hacking and phishing protection insurance, Tving points, and content discount coupons. That package follows criticism reported by CHOSUNBIZ on August 31, when the company was weighing coupons or service passes worth roughly 10,000 won. Sookmyung Women's University consumer economics professor Lee Hong-ju told CHOSUNBIZ that compensation requiring a departing customer to keep using the service "has a hole in the compensation that induces repurchase." The insurance component in the final plan is a partial answer to that critique, though it does nothing about a CI value that cannot be reissued.
Sources: Nearly 40 mil. CJ streaming users' personal info compromised - The... | Nearly 40 mln Tving accounts compromised in massive data breach: pr... | Nearly 40m Tving accounts compromised in massive data breach: probe... | It was investigated that 361 development projects containing 39.54... | Tving boosts security, compensates users after massive South Korea... | 'TVING' breach exposes all 39.54 million accounts ... delayed repor... | TVING Reveals Official Apology and Compensation Plan Three Months A... | Tving data leak spurs coupon plan as Korea weighs penalties, profit...