South Korean streaming platform TVING issued a formal apology on December 3, and announced a comprehensive overhaul of its security infrastructure following a massive personal data breach. Speaking at a press briefing at the Koreana Hotel in Seoul, TVING Representative Choi Ju-hee bowed and apologized to customers for causing anxiety and concern, according to the South Korean news agency Yonhap and local reports.
Government Investigation Reveals Scope of Data Exposure
The apology follows an investigation by a joint public-private probe team under the Ministry of Science and ICT, which revealed that TVING mismanaged access keys for its development and operational environments. According to government findings reported on December 3, the security lapse exposed personal data contained across 3954만개 계정, including duplicate profiles. Prior to the joint investigation’s announcement, TVING had reported a leak affecting 1953만명 to the Personal Information Protection Commission. The commission will verify the exact number of affected individuals.
Government investigators pointed out structural vulnerabilities within the company’s security setup. The probe team noted that TVING employed only four internal information security personnel, excluding outsourced staff, which severely limited the company’s cybersecurity monitoring capabilities.
Overhauling Security Infrastructure with Zero Trust
To address these vulnerabilities, TVING pledged to quadruple its information security budget by 2030 compared to the previous five-year period. The company will restructure its security organization into four distinct divisions: product, cloud, enterprise IT, and compliance security. Furthermore, TVING plans to triple its specialized security workforce over the next five years.
The platform will adopt a “Zero Trust” security model, which relies on continuous verification rather than implicit trust. TVING will consolidate its processes into a standardized company-wide security system requiring step-by-step verification for authentication and access control. Access permissions will be strictly governed by the principle of least privilege, ensuring employees receive access only to what their specific job duties require. Investigators previously found that developers enjoyed unrestricted access to all company projects regardless of their job functions.
Additionally, TVING will establish an Information Security Innovation Advisory Committee reporting directly to the CEO to secure external expert oversight. A practical security consultative body led by the Chief Executive Officer, Chief Information Security Officer, and Chief Privacy Officer will also be created.
Compensation and Relief Package for Affected Users
TVING introduced a relief and compensation package for users impacted by the leak. The company will operate a one-year “safety insurance” policy providing up to 300만원 per person for victims of cyber financial fraud, such as hacking or phishing linked to the leaked data.
All affected customers will receive 5천원 in TVING points to purchase recent movies on the platform. Alternatively, users can choose between a one-month Wavve ad-supported subscription plan or a 5천원 discount coupon for a CGV combo. Applications for the compensation package will be accepted from December 7 to December 30, with benefits applied starting January 6, 2025.
“We will make information security the platform’s most important responsibility and core competitiveness,” Representative Choi Ju-hee said during the briefing, vowing to restore customer trust.
>Keep reading