The government is expected to announce its investigation results regarding the personal data breach at domestic OTT (online video service) provider TVING soon. Key issues include the number of personal data breaches, which is four times the number of TVING subscribers, and whether information belonging to users who signed up via social media (SNS) was compromised.
According to industry sources on the 2nd, the Ministry of Science and ICT is expected to release the joint government-industry investigation team’s findings on the TVING personal data breach as early as this week.
The core issue is whether users’ information was leaked through simple login services.
TVING offers not only account registration via its own accounts but also a simple login function using accounts from Naver (NAVER), Kakao, CJ ONE, Facebook, X, Apple, and other platforms. There are many channels that allow for easier sign-ups compared to others. Simple login allows users to register and log in to TVING without creating a new ID and password, using their existing platform or SNS accounts instead.
It has been revealed that CJ employees who use TVING via the simple login method through CJ ONE had their personal data provided to TVING leaked as well. (Reference: [Exclusive] Personal data of all former and current CJ employees exposed… TVING incident expands) The problem arises if personal information of users who signed up through simple login methods other than CJ ONE was also leaked. The issue could escalate to include concerns about the security of simple login methods such as Naver and Kakao, and whether personal information from external platform accounts linked to simple logins was compromised.
The government is closely examining this aspect as well. It is investigating not only the types and scope of leaked information but also the pathways through which data exited, and whether information linked to external accounts during the simple login process was also leaked.
Another key issue is the actual number of victims. TVING has approximately 5 million subscribers. However, the number of personal data breaches identified by the office of Democratic Party of Korea lawmaker Lee Jeong-heon reaches 19.53 million cases. Even accounting for differences in criteria between individuals and records, the gap is significant. In response, TVING has explained that the figure includes members who have withdrawn and duplicate registrations by the same member.
The government is also carefully examining not only the total volume of leaked personal data but also who the actual victims are and whether information from the same user was counted multiple times.
This TVING incident may lead to calls for improvements in the level of personal data protection among domestic OTT operators and the methods used to link and manage personal data through simple login services. It is reported that TVING plans to announce follow-up measures or compensation plans after the government releases its investigation results.
Meanwhile, this incident came to light on June 3 when TVING announced on its website that an unidentified hacker had breached its database (DB), resulting in a leak of users’ personal information. TVING first confirmed unauthorized external access on May 30 and verified that DB files were transmitted externally on June 2.
in TECH
