How a Hardcoded Key Unlocked 39 Million Korean Streaming Accounts

A credential mistake, not a sophisticated hack

The breach of TVING, South Korea’s second-largest streaming platform, was not the work of a state-sponsored APT or an elite zero-day exploiting a novel vulnerability. It was something far more mundane and far more damaging: someone stole developer access keys that the company had left hardcoded in its own source code.

On May 29, attackers obtained what is called a “development environment access key” — a credential that should have been rotated, encrypted, and stored behind a vault. Instead, according to a joint government-corporate investigation released June 3, the key was visible in plaintext inside the codebase, used for developer convenience rather than security. Within three days, the same threat actors had also secured 43 production environment keys, giving them a direct path from a test server into Amazon Web Services infrastructure that hosted live user data.

By the time TVING acknowledged the intrusion on May 31, approximately 39.54 million accounts had already been exfiltrated. Of those, 22.06 million were active logins — real, breathing accounts that people were using to watch content, make payments, and log in through Naver, Kakao, Apple, and other federated identity providers.

What was taken, and why it matters

The compromised data set is exhaustive. Attackers pulled 70 distinct data fields across 20 categories, including account IDs, passwords, names, dates of birth, phone numbers, email addresses, CI-linked records, and — critically — payment history. Payment history is the detail that transforms this from an annoyance into a financial threat. It means card-on-file patterns, subscription tiers, and transactional behavior were available to whoever bought or sold that dump.

The account breakdown is telling. Of the 39.54 million compromised records, 22.47 million were linked to social sign-in providers — Naver, Kakao, Facebook, Apple, and X. That means the breach likely enabled secondary attacks against those platforms as well, since credential reuse is rampant in Korea, where Kakao and Naver IDs serve as the de facto digital identity for millions.

A further 8.63 million accounts belonged to CJ ONE, the integrated loyalty and membership system that shares data across CJ Group’s retail, entertainment, and financial businesses. Another 7.26 million were direct TVING sign-ups. Each of those buckets represents a different attack surface for phishing, account takeover, and fraud.

The structural failures are systemic

The investigation report paints a picture of an organization that treated security as an afterthought at every layer.

First, there was the credential storage problem. Development environment keys were not isolated in a separate secure store. They were left exposed in the source code so developers could work more conveniently. This is not a rare mistake — it is one of the most common findings in every major breach audit globally. But the scale here is notable: a company with 149 developers and only four dedicated in-house security personnel (excluding outsourced contractors) operating without a secrets management solution.

Second, access controls were essentially nonexistent. Every developer had unrestricted access to every project. There was no principle of least privilege, no role-based segmentation, no necessity-based review. A single compromised key gave an attacker the equivalent of a master elevator pass.

Third, the keys were shared freely. The investigation found that some production keys were circulated among employees via internal messaging apps — a practice that turns every communication channel into a potential leakage point and makes rotation impossible without a complete operational overhaul.

Fourth, and perhaps most damning, a vulnerability discovered during a 2024 simulated hacking exercise was never patched. When an organization conducts its own red team test and then chooses not to act, it is not negligence. It is a decision. Whatever business priorities displaced security budget that year, the cost of that decision is now measured in 39.54 million exposed accounts.

The reporting delay compounds the damage

Under South Korea’s Information and Communications Network Act, companies must report a breach within 24 hours of detection. TVING became aware of the intrusion on the morning of May 31 but did not file its report until the afternoon of June 1 — more than 24 hours later. The delay may seem bureaucratic, but in a breach of this scale, hours matter. Every additional hour of undetected access gives attackers more time to exfiltrate data, plant persistence mechanisms, and map the internal network.

The consequence is a potential fine of up to 30 million won (roughly $21,000 USD) — a penalty that, by any international standard, is negligible relative to the scope of harm.

Why this matters beyond South Korea

Korea’s streaming market is small in global terms, but the mechanics of this breach are universal. The same pattern — hardcoded credentials, overprivileged developers, delayed disclosure — appears in incidents from the Netflix login incident in 2023 to the Hulu breach in 2024. The difference in Korea is the density of linked accounts. A single person’s Kakao ID is typically connected to their bank, their government services, their transit card, and their streaming subscriptions. Compromising one credential does not just threaten one account; it threatens an entire digital life.

For the global streaming industry, the TVING case is a reminder that credential stuffing and insider-style key theft are not distant threats. They are everyday attacks that succeed where security hygiene is weak. The 39.54 million figure is not just a Korean problem. It is a warning that any platform relying on exposed development keys, shared credentials, or delayed breach disclosure is one bad day away from its own headline.

What happens next depends on whether TVING treats this as a compliance exercise or an organizational reckoning. A 30-million-won fine is a line item. Rewiring how 149 developers access production systems, replacing hardcoded keys with a proper secrets manager, enforcing least-privilege access, and actually fixing vulnerabilities found in penetration tests — that is a multi-year transformation. The question is whether the company will do it before the next attacker finds the same door left open.