Gov't launches probe into Tving data breach; CEO vows full accountability

The government has launched a joint public-private investigation into a personal data breach at Tving, South Korea's leading streaming service, after the platform reported unauthorized external access to member information. Tving filed the report with the Korea Internet & Security Agency. CEO Choi Ju-hee pledged full accountability. "Responsibility lies entirely with Tving," she said. "We will see this through to the end to remedy the damage and protect our users."

According to the Ministry of Science and ICT, Tving reported the personal data breach on June 1.

The ministry and KISA immediately requested that Tving preserve all relevant data and began investigating the cause and scope of the incident. The ministry convened an emergency session of its cybersecurity incident review committee, which determined the breach constituted a serious incident. In response, the ministry decided to form a joint public-private task force, citing the scale of the data exposure and the potential for further harm.

The task force will be led by the ministry's director of information security and network policy. In addition to ministry and KISA officials, the team will include private-sector experts in digital forensics and cloud services. The ministry said it plans to release its findings after completing the investigation into the cause and extent of the breach.

Tving said in notices on its website and app that it detected signs of unauthorized access to its member database and file exfiltration on June 2. The compromised data includes member IDs, names, dates of birth, gender, mobile phone numbers, email addresses, connecting information (CI), duplicate registration check information (DI), refund account numbers, passwords and service usage records.

Tving said some mobile phone numbers, some email addresses, refund account numbers and passwords were stored in encrypted form. The company said it does not hold resident registration numbers or active payment credentials, so those were not among the leaked data. However, Tving has not yet disclosed the specific number of affected users.

After confirming the breach, Tving blocked the attacker's IP address, updated its cloud access control policy and strengthened database access monitoring. The company also launched a comprehensive security review to prevent further damage and advised users who share the same account credentials across other services to change their passwords.

Among users, the exposure of CI and DI data has drawn particular concern. CI is a unique identifier assigned to users who have completed identity verification. Experts warn it could be combined with other personal data to identify individuals or enable further harm.

As concerns spread, Choi offered a public apology. "I sincerely apologize for the great worry this personal data breach has caused our users," she said.

Choi acknowledged that unauthorized external access had exposed user data and said the responsibility for failing to protect that information rests with Tving. She said the company is committed to remedying the damage and safeguarding its users.

"We will review our entire security framework from scratch to ensure this never happens again," Choi said. "We will do everything in our power, to the very end, to restore the trust of our users."