TVING

On June 3, 2026, TVING—a South Korean video streaming service owned by CJ ENM—confirmed that user personal information had been leaked due to unauthorized external access. TVING operates as a subscription video-on-demand and over-the-top streaming platform with millions of users across South Korea and increasingly in global markets.

The company disclosed that the breach was identified through security monitoring but has not yet determined the full scope of affected users. The total number of compromised records remains under investigation.

User IDs and passwords. Names. Birthdates. Phone numbers. Email addresses. Refund account numbers. This is a comprehensive user profile—authentication credentials plus identity information plus financial data.

The inclusion of passwords (even if hashed) creates immediate credential stuffing risk. The refund account numbers—likely bank accounts linked for subscription cancellation refunds—add a direct financial exposure layer. Users who reuse passwords across services are at particular risk.

Every TVING user whose credentials were stored. Korean streaming subscribers who may have linked their accounts to Korean Resident Registration Numbers (the Korean equivalent of Social Security numbers) for age verification. Anyone who reused their TVING password on other services.

Birthdates and phone numbers combined with names enable identity verification bypass at other services. The refund account exposure means attackers know where affected users bank. This combination supports both credential stuffing across platforms and targeted social engineering against specific individuals.

TVING is a major platform backed by CJ ENM, one of South Korea's largest media conglomerates. Enterprise-scale streaming platforms invest heavily in availability, performance, and content protection. The business priorities are uptime and preventing content piracy.

But content protection and user data protection are different security domains. DRM systems that prevent movie piracy don't protect user account databases. The security controls optimized for protecting streaming content aren't the same controls that protect user credentials and financial information.

The scope remains under investigation. This typically means the company cannot yet determine which users were affected or how much data was accessed. User databases grow over time—accounts from years of subscriber acquisition, inactive accounts, trial accounts, users who canceled but whose data persists.

Refund account numbers suggest financial data was stored longer than necessary for active transactions. If a user received a refund three years ago, do those bank details still need to be retained? The breach scope expands with every category of data that was kept beyond its operational necessity.

South Korea's Personal Information Protection Act (PIPA) requires breach notification to affected individuals and the Personal Information Protection Commission. The timeline is tight—companies must notify within 72 hours of discovering a breach affecting 1,000+ people.

PIPA also imposes substantial penalties—up to 4% of annual revenue for serious violations. CJ ENM, as the parent company of TVING, faces both regulatory scrutiny and reputational risk in a market where data privacy is increasingly important to consumers. The "under investigation" status extends that uncertainty.