ENKR

TVING account data breach

Add to my breach check

Made public · 39,540,697 accounts

What leaked11

Replaceable

  • Password

Hard to replace

  • Bank account number
  • Mobile number
  • Email address
  • Other profile data
  • Username

Permanent

  • Connecting information
  • Date of birth
  • Purchase or order history
  • Full name
  • Gender
  • Bank account numberrefund account
  • Mobile numberpartly encrypted, but the encryption key leaked too · MSIT, via press
  • Purchase or order historypayment history per MSIT via press
  • Email addresspartly encrypted, but the encryption key leaked too · MSIT, via press
  • Other profile dataDI · duplicate-registration check value; MSIT counted 20 fields of 70 types in total, including the CJ ONE integrated ID · via press

To-dos6 · about 1 h 30 min in all

  1. Change the leaked password everywhere you reused itabout 30 minfreeStops: account takeover
  2. Know the scam pattern: calls and texts that cite these leaked detailsabout 5 minfreeLimits harm from: scam calls, phishing messages
  3. Register as an exposed person with the FSSabout 10 minLimits harm from: scam calls (opens in a new tab)
  4. Block new loans and cards in your nameabout 10 minLimits harm from: scam calls (opens in a new tab)
  5. Turn on two-step sign-in for email and bankingabout 15 minfreeLimits harm from: account takeover
  6. Use an authenticator app or passkey instead of SMS codesabout 20 minfreeLimits harm from: account takeover

What happened next22 events

  1. Undetected 2 events2 days · show events
  2. Response 11 eventsNotice in 7 days · show events
  3. Remedy 1 eventEnded · show events
  4. Penalty 6 eventsOngoing · show events
  5. Disputes 2 eventsOngoing · show events
  1. MSIT: no harm to users confirmed so far, and no sign of the data being traded or circulated, on the dark web or elsewhere
  2. Offered a customer package worth about KRW 20,000 per person: 5,000 TVING points, an entertainment coupon and one year of fraud insurance · up to KRW 3 million; claims by login September 7, 2026 to 09-30, withdrawn members had to re-registerClosed September 30, 2026
  3. Information-security investment to rise about fourfold by 2030 versus the previous five years, and specialist staff in core areas threefold over five years
  4. Formal apology at a briefing on the government findings
  5. MSIT asked for a remediation implementation plan in September and plans implementation checks from January 2027
17 more
  1. Late breach report found under the Network Act; an administrative fine (up to KRW 30 million by law) to be imposed
  2. MSIT joint team result: developer access key stolen, 361 development projects and 39,540,697 accounts (with duplicates) leaked; hard-coded production keys; the theft route could not be established
  3. Plaintiffs in the firm's suits reached 104,522 · 1,051 on June 11, 2026
  4. Damages suit for 1,051 users filed at the Seoul Central District Court, KRW 300,000 claimed per person
  5. Email titled notice of the leak and apology sent
  6. Joint investigation team issued a public security notice to prevent secondary harm
  7. Dedicated damage-consultation call centre opened
  8. CEO apology statement
  9. Notice that on June 2, 2026 it had found signs of unauthorised DB access and a data leak
  10. PIPC opened an investigation on receiving the report
  11. Personal data leak reported to PIPC
  12. Public-private joint investigation team formed after the incident review committee judged the case serious
  13. MSIT and KISA began an on-site investigation
  14. Breach reported to KISA, more than 24 hours after awareness
  15. Theft of a production access key and a suspected leak reported to the security team · the awareness time MSIT used
  16. DB overload alert during the first exfiltration attempt; TVING blocked the query job
  17. Intrusion began
Company
TVING
When it happened
–
Company detected it
Made public
Notice
Leak confirmed
Affected
39,540,697 accounts · MSIT: 22,063,021 active, 8,502,679 dormant, 8,868,174 withdrawn, 106,823 test; people pending PIPC

How the facts developed

  1. MSIT result: 39,540,697 accounts, developer access key stolen, encryption keys leaked, payment history included
  2. Notice in the TVING app listing ID, name, birth date, gender, phone number, email and refund account number (press)

Sources