Vulnerabilities

TVING Lost 39.5 Million Accounts Because Its Developers Left the Keys in the Code

September 4, 2026

5 mins

The Mess: TVING has now confirmed the full scale of the breach: 39.54 million accounts and 361 development projects containing source code were stolen. The attacker started with a stolen development-environment access key, then found production credentials hardcoded and stored in plaintext inside the company’s own source code.

The incident began in late May. TVING detected abnormal database activity on May 30 after a server hit 100% CPU utilization. The company blocked the activity, but treated it as a system-performance problem rather than a confirmed intrusion. The attacker came back.

The second attack was quieter.

Instead of hammering the database until something screamed, the attacker used another compromised production key, created a virtual server inside the environment, copied user data there and exfiltrated it to an external server. CPU usage stayed below 10%, avoiding the alert that had exposed the first attempt.

The Korean Ministry of Science and ICT’s investigation found that the attacker first stole a development access key and used it to access all 361 development projects available to that environment. Those projects contained authentication, payment, recommendation, search and paid-service infrastructure.

Then came the really ugly part.

Investigators found 43 production-environment access keys inside those projects. TVING had not properly separated secrets from source code. Some keys were hardcoded directly into applications, while others were stored in plaintext rather than protected through a proper secret-management system.

The attacker used two of those production keys.

From there, the intruder located database credentials that were also stored without adequate protection, reached the environment containing customer information and extracted the data.

The investigation counted 22.06 million active accounts, 17.37 million inactive accounts and 110,000 test accounts — 39.54 million in total. The number includes duplicate accounts because one person could hold multiple TVING accounts; investigators found one user with as many as 13.

The exposed information covered roughly 20 categories and about 70 types of data, including IDs, one-way encrypted passwords, names, phone numbers, email addresses, dates of birth and linked identity information.

There is an especially nasty detail around phone numbers and email addresses: some were encrypted, but the encryption keys were also compromised, meaning investigators treated that data as effectively exposed in plaintext. Passwords were one-way encrypted and could not be recovered as plaintext from the stolen data, according to the investigation.

And the breach was not limited to customer records.

The 361 stolen development projects represented approximately 30.35 GB of technical assets. They included source code for systems responsible for recommendations, search, authentication, payments and paid services. Investigators said they have not found evidence that the stolen source code has already been used for another attack.

There is also a giant governance failure hiding underneath the technical details.

TVING had discovered exposed development and production access keys during a 2024 penetration test. The weakness was not fixed.

Its developers also had excessively broad access. A single stolen development key could reach every development project because access was not restricted according to job requirements.

The company’s logging strategy made things worse. Some newer systems retained only around six days of access logs. And after the first suspicious event, it took roughly 14 hours for the security organization and chief security officer to receive the incident information.

The government investigation also concluded that TVING’s monitoring focused too heavily on basic system indicators such as CPU utilization. There was no sufficiently effective real-time mechanism watching network traffic and large-scale data access.

The attacker exploited exactly that gap.

First attempt: make enough noise to trigger an alert.

Second attempt: throttle the operation, use a virtual server and quietly move the database out.

That is not sophisticated malware. It is what happens when credentials, permissions and monitoring are badly designed.

The investigation has not identified how the original development key was stolen. Investigators examined phishing, malware, supply-chain attacks, credential sharing or misuse and vulnerability exploitation, including forensic analysis of nine developer devices, but could not establish the initial theft mechanism. Police are continuing the investigation.

TVING has announced a major security overhaul, including increased security investment and stronger key and access management. The company also announced compensation measures for affected customers.

For users, however, the practical problem is already here: personal information has left the company’s controlled environment. Authorities said they have not yet detected confirmed secondary damage or dark-web trading involving the stolen data.

The Damage: 39.54 million exposed accounts, source code for 361 projects and compromised production credentials turn one stolen developer key into a full-chain compromise — exactly the kind of blast radius least-privilege controls are supposed to prevent.
The Fix: TVING users should change any reused passwords immediately, enable MFA wherever available, and treat unexpected messages, password-reset requests and account-recovery calls as potential phishing attempts.

Bugstoday Opinion

This was not a zero-day.

It was not some nation-state APT burning an exotic exploit.

It was a developer key, sitting where developers could reach it, followed by production secrets sitting inside source code, excessive permissions, weak monitoring and a security finding from 2024 that apparently never made it to the finish line.

The attacker only needed one key.

TVING gave them the rest.

Today’s Bugs. Tomorrow’s Breaches.

Technical Sources