(2nd LD) Nearly 40 mln Tving accounts compromised in massive data breach: probe

This will let Google show Yonhap news articles that match or are related to your search

(ATTN: UPDATES with Tving's apology, comments in last 6 paras; ADDS photo) By Kim Eun-jung

SEOUL, Sept. 3 (Yonhap) -- Nearly 40 million user accounts of South Korean streaming platform Tving were compromised in a massive data breach stemming from a hacking incident reported in June, a joint investigation showed Thursday.

The Ministry of Science and ICT announced the results of a three-month government-civilian investigation into the breach at Tving, an online video streaming platform operated by entertainment giant CJ ENM Co.

A total of 39.54 million user accounts and 361 technical assets, including source code, were found to have been compromised in the breach reported on June 1, although the account figure includes multiple accounts held by the same users, the ministry said.

Lim Jeong-gyu, director general for information security and network policy at the Ministry of Science and ICT, announces the results of an investigation into a data breach at streaming platform Tving during a briefing at the government complex in Seoul on Sept. 3, 2026. (Yonhap)

Tving has since strengthened its security measures, and no signs of additional attacks have been detected so far, it noted.

By registration method, they included 7.26 million accounts registered directly with Tving, 8.63 million CJ ONE integrated membership accounts and 22.47 million accounts created through social media log-in services, including Naver, Kakao, Facebook, Apple and X.

Of the total, 22.06 million were active accounts that could be used to log in, while 17.37 million were inactive accounts, including dormant and closed accounts.

The leaked information covered 20 categories comprising 70 types of data, including names, dates of birth, mobile phone numbers, email addresses and connecting information, though the type and extent of information exposed varied depending on how users registered their accounts.

The Personal Information Protection Commission is expected to separately determine the extent of the personal data breach and decide on the amount of penalties.

Investigators found that an unidentified hacker stole a developer's access key and used it to infiltrate Tving's internal systems.

Lim Jeong-gyu, director general for the ministry's information security and network policy, said the investigation team has yet to identify the attacker, adding that a police investigation is underway.

Lim said the stolen data was transferred to accounts located overseas, but authorities have yet to determine where the attacker was based. He said the police investigation is expected to help identify the country from which the attack originated.

Tving CEO Choi Ju-hee (2nd from R) and senior officials bow their heads in apology for the massive personal data breach during a press briefing in Seoul on Sept. 3, 2026. (Yonhap)

The investigation also found that Tving failed to report the breach to the Korea Internet & Security Agency within 24 hours of detecting the incident on May 30, reporting it only on June 1 and potentially facing a fine for the delay.

Investigators warned of potential secondary damage, saying the hacker could exploit the compromised data to carry out further attacks, while leaked personal information could be used for cybercrimes, such as smishing and voice phishing.

The latest incident adds to a series of major personal data breaches over the past year involving South Korean companies, including mobile carriers SK Telecom Co. and KT Corp., as well as U.S.-listed e-commerce giant Coupang.

The breach could deal a setback to Tving at a time when the streaming platform has begun to improve its financial performance, helped by its exclusive digital streaming rights to South Korea's professional baseball league, secured through parent company CJ ENM.

Tving posted 140.7 billion won (US$103.6 million) in sales and 6 billion won in operating profit in the second quarter, marking its first quarterly operating profit since becoming a standalone company in 2020.

Following the announcement, Tving CEO Choi Ju-hee apologized for the personal data breach and pledged to cooperate fully with the investigation.

"We humbly accept the investigation results of the government-civilian joint team and will responsibly implement corrective measures and steps to prevent a recurrence," Choi said at a press briefing.

Tving said it has taken emergency security measures since the breach and developed mid- and long-term cybersecurity plans to strengthen its systems and restore customer trust, pledging to quadruple its cybersecurity investment over the next five years.

As compensation for affected customers, Tving said it will offer one year of hacking and phishing insurance coverage, upgraded streaming benefits, 5,000 won in platform credits and a choice of entertainment coupons.

Tving's logo is seen in this photo provided by the streaming platform under CJ ENM Co. (PHOTO NOT FOR SALE) (Yonhap)

ejkim@yna.co.kr (END)

Personal info of Tving users leaked

7 military officers disciplined over lax management of firearms: data

Los Angeles declares 'BTS Week' ahead of concerts

2 killed in oil products tanker fire off Incheon

(URGENT) S. Korea, U.S., Japan to conduct Freedom Edge trilateral drills Sept. 7-11: S. Korean military

Kim Soo-hyun to resume activities in S. Korea after over a year

S. Korean response team continues search efforts for 9 missing in Nepal floods

(2nd LD) Lee nominates 6 ministers in major Cabinet reshuffle, including finance minister

White House says U.S. policy on N. Korea unchanged, reaffirms Trump's openness to dialogue with Kim

S. Korea's Protestant church offer condolences to Nepal floods victims

Lutnick: Trump gov't considering 'targeted,' thoughtful' tariff policy for semiconductors

N. Korea drops unification goal, cements Kim as sole leader in revised party charter

Trump says S. Korea, Japan, others going to Alaska to 'load up' with oil, build pipelines

Lee reaffirms commitment to replacing Korean armistice with peace regime

(LEAD) S. Korean, Japanese, Turkish frigates being considered for new U.S. frigate class: report

National conference of teachers in N. Korea

Rice paddies in border town

Largest Buddhist sect's leader wins reelection

(2nd LD) Nearly 40 mln Tving accounts compromised in massive data breach: probe

这将使谷歌能够向您展示与您的搜索匹配或相关的韩联社新闻文章。

（注意：更新内容包括Tving的道歉和评论，见最后6段；新增照片）金恩贞

首尔，9月3日（韩联社）——周四公布的一项联合调查显示，韩国流媒体平台Tving近4000万用户账户在6月份报告的一起黑客攻击事件引发的大规模数据泄露中遭到入侵。

科学和信息通信技术部公布了政府和民间联合对娱乐巨头 CJ ENM 公司运营的在线视频流媒体平台 Tving 的安全漏洞事件进行为期三个月的调查结果。

该部表示，在6月1日报告的泄露事件中，共有3954万个用户账户和361项技术资产（包括源代码）遭到泄露，但账户数量包括同一用户拥有的多个账户。

2026年9月3日，韩国科学技术信息通信部信息安全与网络政策司司长林正圭在首尔政府大楼举行的新闻发布会上公布了对流媒体平台Tving数据泄露事件的调查结果。（韩联社）

Tving公司指出，此后已加强了安全措施，目前尚未发现其他攻击迹象。

按注册方式划分，其中包括直接在 Tving 注册的 726 万个账户、863 万个 CJ ONE 综合会员账户以及通过社交媒体登录服务（包括 Naver、Kakao、Facebook、Apple 和 X）创建的 2247 万个账户。

其中，2206万个是可用于登录的活跃账户，1737万个是不活跃账户，包括休眠账户和已关闭账户。

泄露的信息涵盖 20 个类别，包含 70 种数据类型，包括姓名、出生日期、手机号码、电子邮件地址和连接信息，但泄露的信息类型和范围因用户注册帐户的方式而异。

个人信息保护委员会预计将另行确定个人数据泄露的范围，并决定处罚金额。

调查人员发现，一名身份不明的黑客窃取了一名开发人员的访问密钥，并利用该密钥入侵了 Tving 的内部系统。

韩国信息安全与网络政策部部长林正圭表示，调查组尚未确定攻击者身份，并补充说警方正在进行调查。

林先生表示，被盗数据已被转移到海外账户，但当局尚未确定攻击者的所在地。他表示，警方调查有望查明攻击来源国。

2026年9月3日，在首尔举行的新闻发布会上，Tving首席执行官崔珠熙（右二）和高管们就大规模个人数据泄露事件低头道歉。（韩联社）

调查还发现，Tving 在 5 月 30 日发现数据泄露事件后，并未在 24 小时内向韩国互联网安全局报告，而是在 6 月 1 日才报告，可能因此面临罚款。

调查人员警告说，可能会造成二次损害，黑客可能会利用泄露的数据进行进一步攻击，而泄露的个人信息可能会被用于网络犯罪，例如短信钓鱼和语音钓鱼。

最新发生的这起事件，使得过去一年来涉及韩国公司的一系列重大个人数据泄露事件雪上加霜，其中包括移动运营商 SK Telecom Co. 和 KT Corp.，以及在美国上市的电子商务巨头 Coupang。

此次数据泄露可能会给Tving带来挫折，而此时这家流媒体平台的财务业绩已经开始好转，这得益于其通过母公司CJ ENM获得的韩国职业棒球联赛的独家数字流媒体播放权。

Tving 第二季度销售额达 1407 亿韩元（1.036 亿美元），营业利润达 60 亿韩元，这是该公司自 2020 年成为独立公司以来首次实现季度营业利润。

消息公布后，Tving CEO崔柱熙就个人数据泄露事件道歉，并承诺将全力配合调查。

崔在新闻发布会上表示：“我们谦逊地接受政府和民间联合调查组的调查结果，并将负责任地实施纠正措施和步骤，以防止再次发生类似事件。”

Tving表示，自数据泄露事件发生以来，公司已采取紧急安全措施，并制定了中长期网络安全计划，以加强其系统并恢复客户信任，承诺在未来五年内将其网络安全投资增加三倍。

作为对受影响用户的补偿，Tving表示将提供一年的黑客和网络钓鱼保险、升级的流媒体服务、5000韩元的平台积分以及多种娱乐优惠券供选择。

这张照片显示的是流媒体平台 Tving 的标志，该平台隶属于 CJ ENM 公司。（照片非卖品）（韩联社）

ejkim@yna.co.kr (完)

Tving用户个人信息泄露

7名军官因枪支管理不善受到纪律处分：数据

洛杉矶宣布举办“BTS周”演唱会

仁川附近海域油轮起火，2人死亡

（紧急）韩国、美国、日本将于9月7日至11日举行“自由边缘”三边联合军演：韩国军方

金秀贤时隔一年多将在韩国恢复活动

韩国救援队继续搜寻尼泊尔洪灾中失踪的9人

（第二条）李显龙提名6位部长，进行内阁重大改组，其中包括财政部长

白宫表示美国对朝政策不变，重申特朗普对与金正恩对话持开放态度。

韩国基督教新教会向尼泊尔洪灾受害者表示慰问

卢特尼克：特朗普政府正在考虑对半导体行业实施“有针对性”、“深思熟虑”的关税政策

朝鲜放弃统一目标，修订党章巩固金正恩的唯一领导人地位

特朗普称韩国、日本和其他国家将前往阿拉斯加“大量开采”石油，并修建输油管道。

李重申致力于以和平机制取代朝鲜停战协定。

（导语）据报道，韩国、日本和土耳其的护卫舰正被考虑用于建造美国新型护卫舰。

朝鲜全国教师大会

边境小镇的稻田

最大佛教宗派领袖赢得连任

（第二条）调查显示，近4000万个Tving账户在大规模数据泄露事件中遭到入侵。