SEOUL, September 03 (AJP) - Personal information of some 39.5 million users of South Korean streaming service TVING was leaked through a cyberattack,
the government said Thursday. The information breach is the biggest among a recent series of cyberattacks in the country.
A joint public-private investigation team under the Ministry of Science and ICT said the compromised information included names, birth dates, mobile phone numbers, email addresses and connecting information, covering 20 categories and 70 types of data.
Passwords had been protected by one-way encryption and could not be decrypted. Still, encryption keys for phone numbers and email addresses were also stolen, meaning that data were effectively exposed in plaintext, according to the investigators.
The attackers also stole 361 development projects containing source code and other technical assets totaling about 30.35 gigabytes. Investigators found that hackers gained access to TVING's internal systems after stealing a developer's access key.
The investigation cited inadequate key management, insufficient monitoring and security personnel, along with the company's failure to address vulnerabilities identified in a 2024 penetration test. TVING detected the breach on May 31 but reported it to the Korea Internet & Security Agency, the country's internet watchdog, more than 24 hours later, exposing it to a fine of up to 30 million won ($22,000).
The incident follows a string of major data breaches in South Korea last year. SK Telecom suffered a cyberattack that compromised USIM-related information belonging to about 23.24 million users, while recruitment platform Incruit lost personal data belonging to about 7.28 million members.
Lotte Card later confirmed that personal credit information belonging to about 2.97 million customers had been leaked, while Coupang disclosed in November that personal information linked to about 33.7 million customer accounts had been exposed.
South Korea received 447 personal data breach reports in 2025, up 45.6 percent from 307 a year earlier, according to the Personal Information Protection Commission and the Korea Internet & Security Agency.
AJP Takeaways
-
A cyberattack on South Korean streaming platform TVING exposed personal data tied to about 39.54 million user accounts, including names, birth dates, phone numbers and email addresses.
-
Hackers also stole 361 development projects containing source code and other technical assets after gaining access through a developer’s compromised access key, according to a government investigation.
-
The breach comes amid a surge in major cyberattacks in South Korea, as the National Assembly expands the National Intelligence Service’s role in economic and cyber security, including responses to suspected state-backed hacking groups.
Copyright ⓒ Aju Press All rights reserved.
