Tving Data Breach Exposes 39.54 Million Accounts via Stolen Developer Key
A massive security failure at the South Korean streaming giant compromised millions of user records and internal source code.
South Korea's leading streaming platform Tving suffered a massive data breach compromising 39.54 million accounts in June 2026. The incident has triggered a high-level investigation into the company's security protocols and the exposure of sensitive user data.
The breach occurred after a hacker stole a developer's access key, granting unauthorized entry into Tving's internal systems. A joint investigation by the Ministry of Science and ICT and civilian experts revealed the infiltration resulted in the theft of 39.54 million user accounts and 361 technical assets, including the platform's source code. The compromised data is extensive, spanning 20 categories and 70 different types of information, including names, email addresses, mobile phone numbers, and dates of birth.
Breakdown of Compromised Access
The scale of the leak reflects the diverse ways users register for the service. The investigation revealed that 22.47 million social media logins were affected, while 8.63 million CJ ONE accounts and 7.26 million direct registrations were compromised. While the total number of accounts is nearly 40 million, investigators noted that this figure includes inactive accounts and instances where a single user held multiple accounts.
Industry Context
Tving operates as one of the primary over-the-top (OTT) streaming services in South Korea, a market where digital identity security is under constant scrutiny. Historically, the South Korean tech sector has faced severe repercussions for such lapses. The Korea Communications Commission (KCC) has a track record of imposing strict regulatory fines and mandating comprehensive security overhauls for companies that fail to protect consumer data.
Why It Matters
The magnitude of this breach is particularly alarming given the population of South Korea, suggesting a vast portion of the domestic streaming audience has been exposed. Beyond the immediate privacy risk, the theft of source code represents a critical intellectual property loss and potentially provides a roadmap for future exploits. This incident underscores a systemic vulnerability in the streaming industry: the reliance on developer access keys, which, if stolen, can grant attackers "keys to the kingdom" regardless of how strong individual user passwords may be.
What's Next
Attention now turns to the regulatory response from the KCC and whether Tving will be forced to implement a mandatory security overhaul. While the Ministry of Science and ICT has completed its initial probe, the long-term impact of the leaked source code remains a primary concern for the company's technical infrastructure. Users are expected to monitor for phishing attempts using the leaked personal details, though the full extent of how the stolen data is being utilized by the attackers remains unconfirmed.