Tving, Google Korea summoned to national audit over data breaches

Tving CEO Choi Ju-hee said Tuesday that the streaming platform believes a large-scale personal data breach was caused by AI-based hacking, testifying before the National Assembly's Political Affairs Committee national audit.

Choi made the remarks in response to a question from People Power Party lawmaker Cho Jeong-hun, who asked whether the Tving hack had been AI-based. "That is what we suspect," she said.

She added, however, that investigators have yet to determine how the hacker first gained access to Tving's systems, and that police are conducting an investigation.

Asked about the root cause of the breach, Choi said, "I am ashamed to say that, as CEO, I failed to prioritize and pay enough attention to whether our security investment was sufficient."

The Personal Information Protection Commission said it plans to wrap up its investigation into the Tving breach by the end of the year. Commission Chair Song Kyung-hee, responding to a question from Democratic Party of Korea lawmaker Kim Hyeon-jeong about when a fine would be imposed on Tving, said the commission was "working to finalize a disposition before the year is out."

Kim said Tving's compensation plan appeared designed to steer victims back to the platform rather than provide genuine relief. "About 39.54 million records of personal data were leaked, yet the company is nudging people toward its own payment services and handing out affiliate coupons — is that real compensation?" she said. "There is real criticism that this amounts to nothing more than soliciting customers."

Kim said that if Tving fails to submit an improved compensation plan, the commission should conduct a stricter investigation and impose the maximum fines and sanctions permitted by law.

Song said the commission would deliberate carefully among its members before reaching a decision, given that it operates on a consensus basis. She added, however, that "if the compensation plan does not prove genuinely effective, it will not be easy to take it into account as a mitigating factor simply because compensation was offered."

The audit also drew fire over Google's leak of personal data belonging to digital sex crime victims. People Power Party lawmaker Shin Dong-wook pressed Google Korea on how victims' personal information came to be shared with an external research database.

Google Korea CEO Yoon Gu said that while standard procedure prohibits sharing such information, "some data was leaked due to a human error by an employee."

In response, Commission Chair Song said the commission would investigate thoroughly to determine whether the leak was truly the result of human error, as Google claims, or a reflection of the company's broader policy.

When asked about plans to support and compensate victims, Yoon said the matter was "still under internal review."