2026 Tving — developer-key intrusion; MSIT probe finds 39.54M accounts (May–Jun; Sep 3 findings)

Verified Ministry of Science and ICT / KISA joint-probe findings — September 3, 2026 (updates June 2026 company disclosure). Tving (CJ ENM OTT) detected abnormal database-server load around May 30, 2026, identified unauthorized access, and reported to KISA on June 1 (authorities found the report late versus the 24-hour statutory window). The three-month public-private investigation concluded that approximately 39.54 million accounts were compromised (including duplicates; some users held up to 13 accounts): ~22.06M active, ~8.5M dormant, ~8.87M withdrawn, and ~110K test accounts. Registration channels included ~7.26M direct, ~8.63M CJ ONE, and ~22.47M social-login accounts. Investigators said an attacker stole developer access keys, accessed internal systems, and obtained 361 technical assets/source projects containing production credentials; data was transferred overseas. Up to ~20 personal-data items per account may have been involved (ID, encrypted password, name, phone, email, DOB, CI, DI, etc.). The probe also found unremediated issues from a 2024 security simulation and said a fine would be imposed for late reporting. Earlier trade-press estimates (~15M–19.5M) are superseded by the 39.54M account census. recordsAffected 39540000 from MSIT account total; companyConfirmed true.