Tving breach exposes subscriber information from 39.54 million accounts
South Korean streaming service Tving lost information from 39.54 million accounts, including former users. Check your breach notice, change reused passwords and verify unexpected compensation messages through Tving directly.
Open Tving's app or website directly and check your breach notification, including if you previously closed your account. Change your Tving password and any other account using the same password. Verify compensation messages through Tving directly, and do not give callers verification codes or money.
What’s happening
Tving, CJ ENM's South Korean streaming service, disclosed unauthorised access on 3 June. A government investigation subsequently counted 39.54 million compromised accounts, including active, dormant, closed and test accounts. This includes multiple accounts per person; Tving separately estimated about 19.53 million affected people. Exposed information varied by account and included names, dates of birth, phone numbers, email addresses, identity-linking identifiers and password hashes. Some contact details were encrypted, but the encryption keys were also stolen. Investigators confirmed use of a stolen developer access key but could not establish how it was obtained. In September, they reported no detected subsequent attacks or confirmed secondary harm. Tving strengthened security and offered compensation benefits. Additional applications were scheduled to close on 30 October, with distribution starting on 4 November. No final privacy-regulator penalty or arrest was identified in the sources reviewed through 3 November. There is no customer software patch for this breach.
- What
- Breach
- Affects
- Tving streaming service
- Fixed in
- Nothing to patch
- Since
- 3 June 2026
- Closed
- 13 Oct 2026
Timeline
- Update
At a parliamentary hearing, MP Kim Hyun-jung questioned the compensation scheme's effectiveness. Figures she released showed 2,752,030 first-round applicants, or 14.1% of the estimated 19.53 million affected people.
- Update
Tving reopened compensation applications until 30 October. Insurance and points for additional applicants were scheduled to be provided progressively from 4 November; the privacy regulator's investigation remained underway.
- Update
The government investigation confirmed 39.54 million compromised accounts and 361 stolen development projects. The account total includes multiple accounts belonging to the same people; investigators reported no detected additional attacks.
- Made public
Tving publicly acknowledged unauthorised access exposing subscriber information. Chief executive Choi Ju-hee apologised and said affected people were being notified.
- Update
Tving reported the incident to the Korea Internet & Security Agency. The government later found that the report exceeded the 24-hour reporting deadline.
- UpdateNothing to patch
Tving detected unusual database-server load. Investigators later established that an attacker had accessed internal systems and obtained user information.
Sources
- Tving joint investigation findings: government briefingMinistry of Science and ICT · 4 Sept 2026
- Personal info of Tving users leakedYonhap News Agency · 3 June 2026
- Nearly 40 mln Tving accounts compromised in massive data breach: probeYonhap News Agency · 3 Sept 2026
- Tving awaits privacy regulator's determination of breach scopeDealSite · 6 Oct 2026
- Tving compensation scheme questioned after 39.54 million accounts exposedLawissue · 14 Oct 2026