A joint government-civilian team under Korea's science ministry confirmed data from 39.54 million TVING accounts, including 22.06 million active accounts, was leaked, along with 361 development projects containing source code [2]. The probe found the attacker used a stolen development access key, then hard-coded production keys in source code and plaintext database credentials to go deeper; according to Yonhap, leaked data includes IDs, names, birthdays, phone numbers and emails but not resident registration numbers or payment info [2][3]. TVING recommends users change passwords for TVING and any other services using the same account information [1].
Backfill: this event became public on Jun 3, 2026 and we added it on Nov 11, 2026. It is not a new event.
CriticalResolvedBackfillOfficially confirmed
Korean streaming platform TVING breached via stolen dev-environment key; 39.54 million accounts and source code leaked
1 min read
- Disclosed
- Jun 3, 2026
- Occurred
- May 30, 2026
- Published
- Nov 11, 2026
- Last updated
- Nov 11, 2026
- Scale
- 39,540,000 accounts[2]
- CVSS basis
- Our assessment
TVING (CJ ENM)Ministry of Science and ICTCloudWeb applicationsMedia, entertainment & gamingSouth KoreaData breach
- Technology
- DatabaseCI/CD & developer tools
- Attack vector
- Credential abuse
- Impact
- Data exfiltration
- Actor type
- Unknown
- Motivation
- Unknown
On this page
30-second summary
What happened
Who is affected
Industries mainly affected: Media, entertainment & gaming
What to do nowOur advice
- Change passwords for TVING and any other services that use the same account information [1].
Timeline
Technical details
Remediation
Vendor guidance
- 1Change reused passwords mitigate[1]
Change passwords for Tving and other services using the same credentials.
References
Official / primary1
- [2]대한민국 정책브리핑（과학기술정보통신부）2026-09-03Accessed 2026-11-11Snapshot 2026-11-11 sha256 8f10649fb616
“조사단은 티빙 데이터베이스 및 관련 로그 분석을 통해 로그인이 가능한 활성화 계정 2,206만 개, 비활성화 계정 1,737만 개, 테스트 계정 11만 개 등 총 3,954만 개의 계정이 유출되었음을 확인하였습니다.”
Media2
- [1]Yonhap Infomax2026-06-03Accessed 2026-11-11Snapshot 2026-11-11 sha256 f543151037ea
“Tving said, "To prevent potential damage, we recommend changing passwords for Tving and other services that use the same account information."”
- [3]Yonhap News Agency2026-06-03Accessed 2026-11-11Snapshot 2026-11-11 sha256 523c187687d9
“Tving said personal information of its users, including IDs, names, birthdays, phone numbers and e-mail addresses, has been leaked, but their resident registration numbers and payment-related info have not been compromised.”
Corrections
- · confirmation_status: media_reported → official_confirmed韓國官方政策簡報（www.korea.kr）先前被來源分類器誤判為媒體；分類器已修正，該來源本身載明調查結果，故將 confirmation_status 改回 official_confirmed。
Expert help
Still not sure whether this affects you?
Tell us about your environment. We'll check it against this advisory, assess the risk, and give you concrete patch and monitoring steps.
This site aggregates public information and is not security consulting advice. Test remediation steps before applying.