ENKR

TVING account data breach

Add to my breach check

Made public · 39,540,697 accounts

What leaked11

Replaceable

  • Password

Hard to replace

  • Bank account number
  • Mobile number
  • Email address
  • Other profile data
  • Username

Permanent

  • Connecting information
  • Date of birth
  • Purchase or order history
  • Full name
  • Gender
  • Bank account numberrefund account
  • Mobile numberpartly encrypted, but the encryption key leaked too · MSIT, via press
  • Purchase or order historypayment history per MSIT via press
  • Email addresspartly encrypted, but the encryption key leaked too · MSIT, via press
  • Other profile dataDI · duplicate-registration check value; MSIT counted 20 fields of 70 types in total, including the CJ ONE integrated ID · via press

To-dos6 · about 1 h 30 min in all

  1. Change the leaked password everywhere you reused itabout 30 minfreeStops: account takeover
  2. Know the scam pattern: calls and texts that cite these leaked detailsabout 5 minfreeLimits harm from: scam calls, phishing messages
  3. Register as an exposed person with the FSSabout 10 minLimits harm from: scam calls (opens in a new tab)
  4. Block new loans and cards in your nameabout 10 minLimits harm from: scam calls (opens in a new tab)
  5. Turn on two-step sign-in for email and bankingabout 15 minfreeLimits harm from: account takeover
  6. Use an authenticator app or passkey instead of SMS codesabout 20 minfreeLimits harm from: account takeover

What happened next22 events

  1. Undetected 2 events2 days · show events
  2. Response 11 eventsNotice in 7 days · show events
  3. Remedy 1 eventEnded · show events
  4. Penalty 6 eventsOngoing · Back to latest
  5. Disputes 2 eventsOngoing · show events

Penalty: 6 events

Back to latest
  1. MSIT asked for a remediation implementation plan in September and plans implementation checks from January 2027
  2. Late breach report found under the Network Act; an administrative fine (up to KRW 30 million by law) to be imposed
  3. Joint investigation team issued a public security notice to prevent secondary harm
  4. PIPC opened an investigation on receiving the report
  5. Public-private joint investigation team formed after the incident review committee judged the case serious
  6. MSIT and KISA began an on-site investigation
Company
TVING
When it happened
–
Company detected it
Made public
Notice
Leak confirmed
Affected
39,540,697 accounts · MSIT: 22,063,021 active, 8,502,679 dormant, 8,868,174 withdrawn, 106,823 test; people pending PIPC

How the facts developed

  1. MSIT result: 39,540,697 accounts, developer access key stolen, encryption keys leaked, payment history included
  2. Notice in the TVING app listing ID, name, birth date, gender, phone number, email and refund account number (press)

Sources