ENKR

TVING account data breach

Add to my breach check

Made public · 39,540,697 accounts

What leaked11

Replaceable

  • Password

Hard to replace

  • Bank account number
  • Mobile number
  • Email address
  • Other profile data
  • Username

Permanent

  • Connecting information
  • Date of birth
  • Purchase or order history
  • Full name
  • Gender
  • Bank account numberrefund account
  • Mobile numberpartly encrypted, but the encryption key leaked too · MSIT, via press
  • Purchase or order historypayment history per MSIT via press
  • Email addresspartly encrypted, but the encryption key leaked too · MSIT, via press
  • Other profile dataDI · duplicate-registration check value; MSIT counted 20 fields of 70 types in total, including the CJ ONE integrated ID · via press

To-dos6 · about 1 h 30 min in all

  1. Change the leaked password everywhere you reused itabout 30 minfreeStops: account takeover
  2. Know the scam pattern: calls and texts that cite these leaked detailsabout 5 minfreeLimits harm from: scam calls, phishing messages
  3. Register as an exposed person with the FSSabout 10 minLimits harm from: scam calls (opens in a new tab)
  4. Block new loans and cards in your nameabout 10 minLimits harm from: scam calls (opens in a new tab)
  5. Turn on two-step sign-in for email and bankingabout 15 minfreeLimits harm from: account takeover
  6. Use an authenticator app or passkey instead of SMS codesabout 20 minfreeLimits harm from: account takeover

What happened next22 events

  1. Undetected 2 events2 days · show events
  2. Response 11 eventsNotice in 7 days · Back to latest
  3. Remedy 1 eventEnded · show events
  4. Penalty 6 eventsOngoing · show events
  5. Disputes 2 eventsOngoing · show events

Response: 11 events

Back to latest
  1. MSIT: no harm to users confirmed so far, and no sign of the data being traded or circulated, on the dark web or elsewhere
  2. Information-security investment to rise about fourfold by 2030 versus the previous five years, and specialist staff in core areas threefold over five years
  3. Formal apology at a briefing on the government findings
  4. MSIT joint team result: developer access key stolen, 361 development projects and 39,540,697 accounts (with duplicates) leaked; hard-coded production keys; the theft route could not be established
  5. Email titled notice of the leak and apology sent
6 more
  1. Dedicated damage-consultation call centre opened
  2. CEO apology statement
  3. Notice that on June 2, 2026 it had found signs of unauthorised DB access and a data leak
  4. Personal data leak reported to PIPC
  5. Breach reported to KISA, more than 24 hours after awareness
  6. DB overload alert during the first exfiltration attempt; TVING blocked the query job
Company
TVING
When it happened
–
Company detected it
Made public
Notice
Leak confirmed
Affected
39,540,697 accounts · MSIT: 22,063,021 active, 8,502,679 dormant, 8,868,174 withdrawn, 106,823 test; people pending PIPC

How the facts developed

  1. MSIT result: 39,540,697 accounts, developer access key stolen, encryption keys leaked, payment history included
  2. Notice in the TVING app listing ID, name, birth date, gender, phone number, email and refund account number (press)

Sources