Vulnerabilities

TVING Lost 39.5 Million Accounts After Ignoring a Known Security Problem

September 6, 2026September 6, 2026

2 mins

The Mess: South Korean streaming platform TVING has confirmed a breach affecting 39.54 million account records and 361 development projects containing source code and other technical assets. The attacker stole a developer access key, moved from the development environment into production, and reached the customer database.

The ugly part came after the investigation.

A 2024 penetration test had already identified exposed development and production access keys inside source code. The problem remained unresolved. Investigators also found that developers had broad access to projects and that monitoring for abnormal activity was inadequate.

The Damage: The leaked records include names, dates of birth, phone numbers, email addresses and other identifying information; investigators also found 22.06 million active accounts among the 39.54 million records. The stolen technical data included 361 development projects and about 30.35 GB of source code and related assets.

The 39.54 million figure includes duplicate, dormant and withdrawn accounts, so it does not represent 39.54 million individual people. Still, the scale is enormous.

The breach also demonstrates why hardcoded credentials are not a minor code-quality issue. One compromised developer credential reached an environment where production secrets were already exposed, turning a development compromise into access to live customer data.

The Fix: Rotate and revoke exposed credentials, remove secrets from source code, enforce least-privilege access between development and production, and continuously monitor privileged access instead of waiting for the next breach.

TVING says it has implemented emergency security measures and plans to quadruple its cybersecurity investment over the next five years. South Korean authorities are still determining the final regulatory consequences.

Bugstoday’s Opinion

This wasn’t a sophisticated zero-day.

Someone stole a developer key. The attacker found an environment full of excessive access and badly managed secrets. A vulnerability discovered during a penetration test in 2024 was still sitting there when the breach happened.

That’s the part companies should remember: a pentest that produces a report instead of a fix is just expensive documentation.

Today’s Bugs. Tomorrow’s Breaches.

Sources