Tving, 39.54 million accounts breached... encryption keys and dormant accounts also compromised

*This content was translated by AI.

It is reported that 361 technical assets, including source code, and approximately 39.54 million user accounts were leaked from the OTT platform Tving.

The Ministry of Science and ICT announced on the 3rd at the Government Seoul Office the results of the joint government-industry investigation into the Tving security breach.

Analysis of Tving's database and related logs revealed that attackers illegally penetrated Tving's internal systems and leaked information from a total of 39.54 million accounts. Of these, 22.06 million were active accounts capable of login, while 17.37 million were inactive accounts. The inactive accounts included 8.5 million dormant accounts and 8.87 million deleted accounts; additionally, 110,000 test accounts were also leaked.

The leaked information included 20 items (70 types): ID and password (one-way encrypted), CJ ONE integrated ID, name, Daejeon-registered phone number, email address, date of birth, linked information (CI), and others. While some phone numbers registered in Daejeon and email addresses were encrypted, the encryption keys were also leaked along with them.

The incident was first detected on May 30 when a sudden surge in workload on Tving's database server raised initial red flags. During its analysis, Tving confirmed that an unauthorized individual had accessed internal servers without permission to view user information and reported the security breach to the Korea Internet & Security Agency (KISA) on June 1.

The Ministry of Science and ICT began a joint field investigation with KISA on June 2 and formed a joint government-industry investigation team the following day to examine the scale of damage, attack pathways, and information security management systems.

<© STARNEWS. All rights reserved. No reproduction or redistribution allowed.>

*This content was translated by AI.