Tving Data Breach Exposes Personal Information of South Korean Streaming Users South Korean streaming platform Tving confirmed a data breach on Wednesday, revealing that unauthorized access to user information had occurred. The compromised data may include user IDs, names, dates of birth, gender, mobile phone numbers, and email addresses. However, the company stated that resident registration numbers and payment details were not exposed. The breach was traced to an unidentified hacker who accessed a database and transferred user data to an external location. Tving responded by blocking the attacker’s IP address and implementing enhanced security measures, including updates to cloud access control policies. A dedicated customer support center was also established to assist affected users. While Tving did not disclose the number of impacted users, local app analytics firm Mobile Index reported that the platform had 7.7 million monthly active users as of April, ranking third among South Korea’s major streaming services. Netflix led with 14.7 million users, followed by Coupang Play (9.1 million), Wavve (3.8 million), and Disney+ (3.4 million). The incident highlights ongoing cybersecurity risks in the region’s digital entertainment sector.

Tving Data Breach Compensation Claims Fall Short, Drawing Criticism A massive data breach at South Korean streaming service Tving has left 19.53 million users exposed, yet only 2.75 million (14.1%) have filed compensation claims as of September 30, raising concerns over the program’s accessibility and fairness. Tving reported the breach to the Personal Information Protection Commission in June, offering affected users a compensation package that includes one year of hacking/phishing insurance, three months of premium features, and 5,000 won (~$3.70) in Tving points. The company estimates the total cost at 55.04 billion won (~$40.8 million), or roughly 20,000 won (~$15) per claimant a sum critics argue is insufficient given the breach’s impact. Users have criticized the complex application process, which requires logging in, verifying identity, and manually submitting a claim. Many, including older individuals with limited digital access, may struggle to complete the steps. One subscriber, a 30-year-old Tving user, described the process as overly burdensome, noting that victims must navigate the system themselves despite the company’s responsibility for the breach. The low claim rate has drawn sharp criticism from Rep. Park Jung-ha of the People Power Party, who called the compensation effort "window dressing rather than genuine redress." He contrasted Tving’s approach with SK Telecom’s 2023 breach response, where 500 billion won (~$370 million) in automatic bill discounts and other relief was provided to 24 million customers without requiring individual applications. Park also raised concerns that Tving’s compensation structure calculated based on the total number of affected users rather than actual claimants could be an attempt to minimize future fines. Some victims reportedly hesitate to apply, fearing it may weaken potential legal claims. While Tving executives, including CEO Choi Joo-hee, publicly apologized in November, lawmakers and users argue the company must extend the application period, simplify procedures, and increase compensation to address the harm effectively.

South Korea’s Tving Breach Exposes 39.5 Million Users, Highlights Enforcement Disparities South Korea’s government recently concluded its investigation into the Tving data breach, revealing a massive compromise of 39.54 million users’ personal information. The attack, attributed to unidentified hackers, involved the theft of 70 types of sensitive data, including phone numbers, email addresses, dates of birth, and payment histories, as well as source code and technical assets, which were exfiltrated overseas. The attackers’ origin remains unknown. Tving failed to meet the 24-hour breach notification requirement, raising concerns that the stolen data could fuel phishing attacks and further cybercrime. While the government’s response including a technical briefing, a company apology, and a referral to the Personal Information Protection Commission (PIPC) for potential penalties was deemed measured and professional, no fines have been imposed yet. The incident underscores broader inconsistencies in South Korea’s enforcement of data protection laws. A comparison with other recent breaches reveals stark disparities: - Coupang (2025): A former employee stole 3,000 records (names, emails, addresses, and order details) over several months, with no financial data or passwords compromised. The insider confessed, cooperated, and deleted the data, with no evidence of misuse. Despite this, Coupang, a U.S.-based company, faced a record ₩624.7 billion fine and aggressive investigations by 10 Korean agencies, including threats of criminal charges against its executives. - Kakao Pay: The company deliberately sent credit and transaction data of 40.45 million users to China’s Alipay without consent over six years. Its penalty was just ₩5.97 billion less than 1% of Coupang’s fine. - SK Telecom: Lost data on 23 million subscribers, including SIM-cloning authentication keys, yet received a ₩134.8 billion fine roughly one-fifth of Coupang’s. The lightest penalty went to the company that knowingly transferred financial data to China, while the heaviest was levied against an American firm whose insider recovered the stolen data before harm occurred. Adding to the controversy, the South Korean government concealed a major breach of its own: Hackers infiltrated the Korea National Diplomatic Academy (under the Ministry of Foreign Affairs) from April 2025 to February 2026, accessing names, positions, and email addresses of current and former diplomats a direct threat to national security. The intrusion went undetected for 10 months and was not disclosed for another five, with no penalties, hearings, or disciplinary actions taken. These disparities raise concerns about selective enforcement, potentially undermining cybersecurity cooperation between South Korea and the U.S. while pushing consumers toward less secure, less accountable platforms many of them Chinese. The case highlights the need for consistent, fair application of data protection laws to maintain trust in digital security and international partnerships.