Tving data breach affected 19.53 million users, fourth-largest in South Korean history

A data breach at streaming platform Tving affected about 19.53 million users, according to government documents obtained by a lawmaker.

Democratic Party of Korea lawmaker Lee Jeong-heon said Sunday that data submitted by the Personal Information Protection Commission and the Ministry of Science and ICT confirmed the breach affected 19.53 million people — more than 6.5 million above the government's initial estimate of about 13 million.

The incident ranks as the fourth-largest personal data breach in South Korean history, behind Coupang Inc (about 37.56 million), Cyworld and Nate (about 35 million), and SK Telecom (about 23.24 million).

The leaked data included user IDs, names, dates of birth, passwords, refund account numbers, and two government-issued identity linkage codes. The linkage codes are particularly concerning because they are difficult to change, raising the risk of identity theft and other secondary harm.

The government is investigating why the breach total far exceeds Tving's paid subscriber base of about 5 million and its monthly active user count of about 8.82 million as of May. Investigators are also looking into whether the leaked data includes information from withdrawn members, dormant accounts, and accounts created through partner services.

Authorities are also examining whether Tving responded appropriately after detecting the breach. Lee said Tving noticed unusual activity on May 30 but did not confirm that a large file had been sent externally until June 2. He added that the finding would be subject to final verification through the ongoing government investigation.

"We again sincerely apologize to our customers for the concern caused by this incident," a Tving official said. "A joint public-private investigation team is currently looking into the circumstances of the breach, its scale, and the scope of impact. We will swiftly implement customer protection measures and fulfill our responsibilities, including providing necessary support and compensation."

Meanwhile, legal action is set to begin as affected users move to seek damages. Law firm Jihyang filed a lawsuit against Tving at Seoul Central District Court on June 11 on behalf of 1,051 users whose data was compromised. Each plaintiff is seeking 300,000 won ($195) in damages.

The legal team plans to argue that Tving bears liability because victims face a permanent risk of secondary crimes and because the company collected personal data unnecessary for its service.