TVING's 40M Breach Proves Your Deleted Account Isn't Safe

Your deleted account is still there

When you close a streaming account, the intuitive assumption is that your data disappears with it. TVING — Korea’s largest OTT platform, owned by CJ ENM — just proved that assumption is dangerously naive. A government-investigated breach has laid bare 39.54 million accounts, and nearly a third of them were either dormant or already deleted.

The numbers are stark. Of the compromised records, 22.06 million belonged to active users. But another 8.5 million were classified as “dormant” — accounts that had gone unused long enough to be flagged. And 8.87 million had been formally deleted by subscribers who thought they were gone. An additional 110,000 were test accounts. No one is safe from the backlog.

To be clear, 39.54 million does not mean 39.54 million unique victims. Investigators confirmed that one person could hold up to 13 accounts across sign-up channels. But even accounting for that overlap, this remains one of South Korea’s largest consumer data exposures on record.

What exactly leaked

The compromised dataset spans 70 distinct data fields across 20 categories. Names, email addresses, phone numbers, birth dates, CI (Connection Information — a Korean identity linkage key), and payment history were all extracted. Passwords were stored with one-way hashing and appear unrecoverable. That is the only silver lining.

The worse finding: some phone numbers and emails were encrypted, but the encryption keys were leaked alongside them. Effectively, this is a plaintext data dump. The attacker did not need to crack anything. They simply walked in and took everything.

How they got in

The breach path tells a story of preventable failures stacked on top of each other.

Attackers first stole a developer’s access key — credentials meant for the internal development environment. From there, they moved laterally into TVING’s internal systems. Inside, they found 361 development projects totaling 30.35 gigabytes of source code. Among that code were 43 hardcoded production access keys — live credentials for the actual service infrastructure, sitting openly in files where any developer with repository access could see them.

That pattern — production keys embedded directly in source code — was not new. TVING’s own penetration test in 2024 flagged it as a vulnerability. The company took no remedial action. Two years later, an external attacker found the same door left wide open and simply walked through.

The staffing gap

Another structural problem stands out. TVING has 265 total employees, 149 of whom are developers. Yet its in-house information security team — excluding outsourced contractors — numbers just four people. For an organization running a streaming service with tens of millions of accounts and the technical complexity of content recommendation algorithms, that is a remarkably thin security perimeter.

The ratio alone explains a lot. When four people are responsible for securing systems used by nearly 40 million accounts, gaps are not a matter of if — they are a matter of when. The 2024 finding that went unfixed was likely one of many that never made it to the top of a small team’s backlog.

Response delays compound the damage

TVING’s incident response timeline adds insult to injury. Suspicious activity was detected on May 30, but it took approximately 14 hours for the finding to reach the Chief Information Security Officer. The mandatory report to the Korea Internet & Security Agency (KISA) also came after the legal 24-hour window had expired.

Delayed detection means prolonged exposure. Every hour between initial compromise and internal awareness is an hour the attacker had unrestricted access to databases they should never have reached. The 30 million won administrative fine that the Ministry of Science and ICT plans to levy — the maximum allowed under current regulations — amounts to roughly $21,000. For a company of TVING’s size, it is a rounding error.

What this means beyond Korea

Korea’s identity ecosystem makes this breach particularly consequential. The CI (Connection Information) field is a linkage key that ties together national ID numbers, phone registrations, and other personal identifiers across government and private databases. Exposure of CI alongside names and phone numbers creates a powerful reconstruction vector — an attacker can connect a TVING profile to a broader identity footprint in a way that pure email-or-password leaks do not allow.

The lessons, however, are universal.

First, retention without rationale is risk accumulation. Every dormant and deleted account that lingers in a database is a liability waiting for someone to find the right key. Data minimization — deleting or anonymizing records that no longer serve a business purpose — is not just a privacy best practice. It is a security imperative. Platforms that hoard legacy account data are storing ammunition.

Second, hardcoded credentials are a solvable problem with almost no excuse. CI/CD pipelines, secret management tools like HashiCorp Vault or AWS Secrets Manager, and basic code review practices can prevent production keys from ever appearing in source repositories. The fact that TVING’s own testers found this in 2024 and did nothing suggests the issue was cultural, not technical.

Third, security staffing scale matters. Four in-house security personnel for an organization of TVING’s scope is not a sustainable posture. Automated vulnerability scanning, dedicatedSecOps teams, and clear escalation paths are not luxuries — they are the baseline for any platform holding consumer data at this volume.

Who wins, who loses

The attackers win — they walked away with a rich dataset spanning tens of millions of Korean consumers, full identity linkage capability, and proprietary source code that reveals how TVING’s recommendation and search algorithms work. That code has strategic value beyond this breach; it could inform competitors or enable more targeted attacks against similar platforms.

TVING loses credibility. Its brand promise — personalized entertainment — now carries the subtitle: we also store your dead accounts and leave the keys under the doormat. The regulatory fine will sting little. The reputational cost will linger.

Users lose twice: first when their data is stolen, and again when they realize that clicking “delete account” was largely symbolic.

The broader industry loses the comforting myth that deletion equals disappearance. As OTT consolidation accelerates across Asia — Disney+, Netflix, Amazon Prime, and regional players all racing for subscribers — the lesson from TVING should be absorbed quickly: every dormant record is a future headline, and every hardcoded key is a door someone will eventually walk through.