[Digital Today reporter Jin-ho Lee] Online video service (OTT) platform Tving has suffered a hacking incident that leaked information on 39.54 million accounts. Virtually all Tving accounts were stolen. The attacker stole an access key held by a developer, penetrated the development environment and then accessed the production environment to steal personal information.

The Ministry of Science and ICT on Wednesday announced the results of a joint public-private investigation team’s probe into the Tving breach incident, formed with the Korea Internet & Security Agency (KISA) and others.

The team confirmed abnormal access to Tving’s user information database and examined how the developer access key was stolen, the attacker’s intrusion route, the scale of the leak and company-wide information security management systems.

◆All 39.54 million accounts leaked...actual number of affected users not yet confirmed

The team said the leaked accounts totalled 39.54 million: 22.06 million active accounts that can currently log in, 17.37 million inactive accounts such as dormant or withdrawn accounts, and 110,000 test accounts. This effectively means all Tving accounts were leaked, the team explained.

The leaked information covered 70 types across 20 items, including IDs and passwords, names, mobile phone numbers, email addresses, dates of birth, connected information (CI) and payment history. CI is a unique value used to identify the same user in place of a resident registration number. It is created and collected during identity verification such as paid payments or adult verification.

The 39.54 million leaked accounts differ from the number of actual affected users. Users can sign up through multiple channels, including direct registration, CJ ONE integrated membership and social media (SNS) simple sign-up, and duplicate accounts for the same person were included. The investigation also confirmed a case in which one person held up to 13 accounts.

Among 19.04 million accounts that had CI, about 5.8 million duplicate accounts were identified. Removing them brings the figure to about 13.24 million. An average of 11.1 items were leaked per CI-holding account. Of the 13.24 million CI accounts, about 3.7 million were dormant and about 50,000 had been withdrawn. Among 20.4 million accounts without CI, an average of 4.6 items were leaked.

About 19.54 million accounts that Tving previously reported to the Personal Information Protection Commission were also not a confirmed number of victims. The specific scale of the personal information leak will be confirmed after additional investigation by the Personal Information Protection Commission.

The investigation found passwords were leaked in a one-way encrypted form, making plaintext decryption impossible. Mobile phone numbers and email addresses were partially encrypted, but because the encryption keys were also leaked, the team judged it to be effectively equivalent to a plaintext leak.

For users who used SNS simple sign-up such as Naver or Kakao, no additional information for those accounts was leaked. Information passed from SNS services to Tving is mostly limited to name and email address. Tving later separately collects mobile phone numbers and CI and DI through identity verification.

Technical assets were also leaked. The attacker took 361 development projects containing source code, about 30.35 GB. They included technologies related to personalised content recommendation and search algorithms, user management and authentication systems, payment management and operation of paid services.

The team said, "So far, no user harm from misuse of leaked information or signs of illegal trading and distribution through the dark web have been confirmed."

◆Failed to judge it as hacking after blocking first attack...24 GB leaked the next day

The incident began with the theft of a development environment access key held by a developer. The team divided the attack into five stages: intrusion into the development environment, access to the production environment and theft of a production access key with administrative authority, intrusion into the production environment, a first leak attempt, and a second leak attempt and large-scale information leak.

Using a development environment access key obtained in advance, the attacker accessed Tving’s development environment without authorisation on May 29. The attacker then took accessible development projects. Initially, 14 projects were leaked, and the attacker later took all 361 development projects.

To determine how the initial development environment access key was stolen, the team conducted forensic analysis of nine developer devices and investigated the possibility of phishing, malware, supply chain attacks, sharing and misuse of access keys and exploitation of vulnerabilities.

The team ultimately could not confirm how the development environment access key first fell into the attacker’s hands. Relevant logs were already beyond the retention period, and device forensics found no evidence supporting a specific attack scenario. The attacker’s identity has also not been confirmed, and a police investigation is under way.

The leaked development projects became the key to the large-scale account leak. The 361 projects contained 43 production environment access keys. Of these, 41 were hard-coded by directly entering the keys into the source code, and some were stored in plaintext without separate encryption.

The attacker used two of these access keys to penetrate the production environment. The attacker then found IDs and passwords that could access the user information database stored without encryption and stole them. The attacker used this information on May 30 to attempt a first information leak. During this process, the database server CPU usage surged to 100 percent, triggering an abnormal-sign alert, and Tving blocked the ongoing data exfiltration work.

Tving viewed the warning at the time as a general system anomaly, not a sign of a security incident. Park Yong-gyu (박용규), deputy head of the investigation team, said, "If (Tving) had known it was hacking at the time, it would have taken action," adding, "Because it saw it as excessive CPU use, it did not take additional steps beyond blocking access, which led to the second incident."

The attacker changed tactics the next day, May 31. The attacker created a new virtual server and used it as a channel to move user information outside. The attacker leaked about 24 GB of user information to an overseas server and then deleted the virtual server to erase traces.

In the second attack, the same CPU overload warning as in the first attack did not occur. The team judged, given that CPU usage remained within 10 percent at the time, that the attacker intentionally limited CPU usage to avoid detection.

Traces showing data leaving for an overseas server were confirmed, but it has not been confirmed whether the data remains on that server. The location of the server and the data flow are expected to be revealed through the police investigation.

◆All developers had access to all projects...vulnerability found in 2024 also left unaddressed

Multiple problems were identified in Tving’s information security management system. Developers hard-coded development and production environment access keys in source code or stored them in plaintext, and some access keys were shared with others via internal messengers and other means.

In particular, all developers could access all development projects. The structure meant that stealing just one development environment access key allowed access to all projects. It also failed to properly establish procedures to manage the issuance, use, change, disposal and regular inspection of access keys.

Security monitoring relied on simple system indicators such as CPU load. Systems were insufficient to detect and block abnormal network or data flows in real time. It also lacked access control policies such as allowing access only from authorised internet protocol (IP) addresses or applying multi-factor authentication (MFA).

It also lacked information security personnel. Tving had 265 employees, including 149 developers, but had about four in-house dedicated information security staff excluding outsourced personnel. The ministry said it will review whether the level is appropriate by comparing similar industries and company size if Tving later prepares its own plan to expand staffing and budget.

Signs also emerged that Tving left already identified vulnerabilities unaddressed. Tving found through a mock hacking test in 2024 that development and production environment access keys were hard-coded in source code but did not improve them. It kept records for new virtual private network (VPN) equipment access logs for only about six days and did not sufficiently carry out regular security checks such as installing and updating antivirus software on work PCs.

Access key management issues are also specified in information security management system (ISMS) certification standards, but they were not followed. The ministry said it will review improvements to the ISMS certification system.

◆Took 14 hours to notify information security team...report filed more than 24 hours after recognition

Problems were also found in incident response and internal reporting. The first abnormal sign occurred at about 6 p.m. on May 30, but it took about 14 hours for the situation to be properly delivered to the dedicated information security organisation overseeing incident response and the chief information security officer (CISO).

The team judged that Tving recognised the incident at 10:10 a.m. on May 31, when it shared with the information security team the suspected theft of a production environment access key and possible information leak. Under the current Information and Communications Network Act, a report must be filed with the Ministry of Science and ICT or KISA within 24 hours of recognising a security incident. But Tving reported it to KISA at 3:08 p.m. on June 1, about 29 hours after recognition.

The team said it took time to analyse the cause after the initial abnormal alarm and the situation was not immediately shared with the information security organisation. The ministry plans to impose an administrative fine of up to 30 million won under the Information and Communications Network Act for the delayed report.

The team instructed Tving to build a system for key management, control and access rights and to clarify operational management standards. It also told the company to strengthen access control policies such as log storage and management, key history management, abnormal behaviour detection and monitoring of large-scale data queries. It said Tving should secure sufficient dedicated information security personnel and budget and improve reporting systems in the event of a security incident.

The ministry will receive an implementation plan for recurrence prevention measures from Tving within this month and check implementation from October to December. From January next year, it plans to conduct full-scale implementation checks and order corrective actions for matters requiring supplementation.

But because the incident occurred in May, strengthened regulations will not apply. A revised Personal Information Protection Act that allows punitive penalties of up to 10 percent of total revenue for personal information leaks takes effect on Sept. 11, and a revised Information and Communications Network Act that allows investigations to begin even before a company reports takes effect on Oct. 1. The size of any penalty will also be calculated after a detailed investigation by the Personal Information Protection Commission.

Tving also apologised again for the incident. Choi Ju-hee (최주희), Tving’s chief executive, said, "We humbly accept the results of the joint public-private investigation team’s investigation," adding, "We sincerely apologise for causing concern and anxiety to our customers. We will responsibly implement measures to prevent recurrence."