TVING Hack Exposed Source Code—A Warning for Korea's Tech Sector

The Hack That Went Beyond Data

Korea’s second-largest streaming service, TVING, suffered a breach that should unsettle every tech company in the country. Nearly 40 million user accounts and 361 source code projects were exfiltrated, but the more alarming finding wasn’t the scale of personal data stolen—it was the discovery that production credentials were sitting in plain text inside the very codebase the attackers walked away with.

The South Korean government’s joint investigation team, led by the Ministry of Science and ICT, released its findings Wednesday. The picture that emerged was not one of a sophisticated external attack exploiting a zero-day flaw, but of a company that had been warned about a critical vulnerability and chose not to fix it.

How the Attack Unfolded

The attacker gained entry on May 29 by stealing a developer’s access key. That key opened the door to TVING’s internal development environment—a place where engineers write and test code before anything reaches users. Once inside, the attacker found something that should never exist in a code repository: 43 operational keys for the live production environment.

Of those 43 keys, 41 were hardcoded directly into the source code. This is a basic security violation that any developer with passing familiarity with secure coding practices would know to avoid. Production secrets belong in encrypted vaults, not in .py or .java files committed to a project.

Armed with those production keys, the attacker pivoted from the development environment to the live cloud infrastructure and the user database. On May 31, they spun up a virtual server, dumped approximately 24 gigabytes of user data onto it, transferred the data to an external server, and then deleted the virtual server to erase traces. The whole operation took roughly two days.

What Was Stolen—and What Wasn’t

The 39.54 million accounts include 22.06 million active accounts, 17.37 million dormant or deleted accounts, and 110,000 test accounts. Not all belong to unique individuals—some users held as many as 13 accounts. The actual number of affected people is therefore lower, though still enormous.

The leaked data covered 70 types of information across 20 categories: names, birth dates, phone numbers, email addresses, linkage information (CI identifiers), and payment history. Phone numbers and email addresses were partially encrypted, but the encryption keys were also stolen, making the data effectively readable in plaintext. Passwords, stored with one-way hashing, were not reversible—and that is the single silver lining in a otherwise devastating breach.

But the source code leak changes the calculus entirely. The exfiltrated projects contain the architecture behind TVING’s recommendation engine, search algorithms, user authentication systems, and payment management. These are not trivial files. They represent the proprietary logic that differentiates a streaming platform in a market where Netflix, Disney+, and Amazon Prime compete aggressively for Korean subscribers.

The Negligence Factor

Perhaps the most damaging revelation from the investigation is that the hardcoded key vulnerability had already been identified in a 2024 simulated hacking exercise. The security team knew. They did not fix it.

This is not a case of an unknown unknown. It is a known risk that sat unpatched for over a year, waiting for an attacker who happened to steal the right developer key at the right time.

The investigation also exposed a stark resource imbalance. Of TVING’s 265 employees, 149 are developers. The internal security team—excluding outsourced personnel—numbers only around four people. That ratio suggests a company that has scaled its engineering output far beyond its capacity to secure it.

The Ministry of Science and ICT also confirmed that TVING missed the legally mandated 24-hour reporting window for security incidents, delaying notification to the Korea Internet & Security Agency (KISA). A fine under the Information Communications Network Act is expected.

Why This Matters Beyond TVING

The TVING breach is a case study in a pattern that likely extends across Korea’s technology sector. The country’s digital economy moves fast. Companies scale engineering teams rapidly, often prioritizing feature delivery and market share over security infrastructure. Hardcoded credentials in source repositories are a common lapse, particularly among companies that grew quickly and never institutionalized security review processes.

The 361 leaked source code projects are a concern not just for TVING’s competitiveness but for Korea’s broader technology ecosystem. Competitors now have visibility into TVING’s authentication flows, payment systems, and algorithmic approaches. This is intellectual property exposure at a scale that goes well beyond what most data breach reports capture.

For Korean regulators, the incident raises uncomfortable questions about enforcement. A simulated hacking exercise in 2024 surfaced the exact vulnerability that enabled this breach. The company failed to remediate. It also failed to report promptly. The Ministry has ordered TVING to submit a reoccurrence prevention plan this month, with compliance checks scheduled for October through December and a formal review beginning in January.

Who Wins, Who Loses

TVING loses credibility with subscribers who trusted it with their payment information and viewing habits. Competitors gain from the leaked source code, however marginally—enough to make the breach costly beyond any fines or settlement payouts. Regulators gain ammunition to tighten enforcement, but only if they follow through.

The attackers walk away with one of the largest Korean data breaches on record and a blueprint of a major tech platform’s internal systems. For the nearly 40 million affected users, the consequences will play out over years in the form of phishing attempts, identity theft, and targeted scams using their personal data.

The real lesson is structural. Korea’s OTT wars are intensifying, and security is becoming a competitive differentiator as much as content library size. TVING’s failure was not a technical mystery. It was a management failure—a company that grew faster than its security posture could keep up, ignored a red flag when it was handed to them, and paid for the omission in the most expensive way possible.