'39.54 million accounts' data breach at TVING…Revenue-linked fine faces 'equity' test

Concerns are mounting over the level of sanctions to be imposed by the Personal Information Protection Commission after it emerged that personal data from 39.54 million accounts—including duplicate entries—were leaked from OTT service TVING. While Coupang received a fine of 624.681 billion won for breaches including personal information leaks, TVING, with annual revenue in the 400th-billion-won range, could face a penalty capped at around 10 billion won under current law. Some critics argue that the structure, where smaller revenues lead to smaller fines, inevitably raises equity concerns.

According to the IT industry on the 5th, of Coupang’s total fine, 423.575 billion won was for data leaks and safety measure violations, while the remaining 201.16 billion won related to a separate violation involving the unauthorized collection of usage behavior from 11.17 million users on third-party websites and apps. Even considering only the amount tied to data leaks, TVING’s calculated fine at 3% of its revenue (12.18 billion won) is 35 times smaller than Coupang’s leak-related penalty.

According to an investigation released by the Ministry of Science and ICT on the 3rd, the leaked TVING accounts consisted of 22.06 million active accounts, 17.37 million dormant or deleted accounts, and 110,000 test accounts. The leaked data included 20 categories across 70 types: user ID, password, name, date of birth, mobile phone number, email, linked information (CI), and more. Mobile numbers and emails were leaked along with their encryption keys, leading the government to treat them as effectively plaintext leaks. Additionally, source code containing authentication, payment, and search algorithms was stolen from 361 development projects totaling 30.35 GB—a type of technical asset not previously seen in Coupang’s breach.

Inadequate security management was also exposed. Access keys were exposed in the source code or stored in plaintext, and despite identifying this risk during a simulated hacking exercise in 2024, TVING failed to address it. When data was first exfiltrated, CPU usage on the database server spiked to 100%, yet TVING dismissed it as a load issue rather than an intrusion. It took 14 hours for the incident to be shared within the information security organization.

Coupang’s final breach involved approximately 37.5 million individuals, combining 33.22 million members and 4.33 million non-members. SK Telecom had 23.24 million won subscribers affected by leaks of 25 types of data including SIM authentication keys, resulting in a fine of 134.791 billion won.

The social response burden also differed significantly. For Coupang, the National Assembly held five formal inquiries and hearings; then-CEO Park Dae-jun resigned; and a cross-government task force involving over ten ministries launched an investigation. SK Telecom faced a new business suspension order, full exemption from penalty fees, and three rounds of National Assembly inquiries. In contrast, TVING’s breach was overshadowed by the local election period in early June, and its full scale only became public three months later.

Under current Personal Information Protection Act regulations, the maximum fine is 3% of a company’s total annual revenue. Applying this to TVING’s last-year revenue of 405.98138 billion won yields a potential fine of 12.17944 billion won. The revised law, effective the 11th, allows penalties up to 10% of revenue if the breach involves intentional or grossly negligent actions affecting over 10 million people; however, since TVING’s intrusion ended on May 31, the current 3% framework applies in principle.

Revenue-linked penalty systems are used in South Korea and the EU (2–4% of revenue) and China (5% of prior-year revenue). Japan imposes a fixed maximum fine of up to 100 million yen (approximately 1 billion won). In South Korea, marriage information agency Duo previously faced criticism for receiving only an 1.197 billion won fine despite leaking data on over 427,464 individuals across 24 categories including blood type, religion, and educational background—a case widely described as a "straw-penalty."

An industry representative stated, “Under the current system, the equation ‘personal information value = corporate revenue’ holds true.” They added, “The penalty should reflect aggravating factors such as the number of affected individuals, sensitivity of the leaked data, known vulnerabilities that were ignored, and delays in reporting. Only then can fair sanctions be imposed commensurate with both the scale and qualitative severity of the breach.”