TruthFoundry News
Better tools. Better news.
Thursday, September 3, 2026 · UTC
227 of 1221 in this edition
tech

Tiving CEO Apologizes for Leaking 39.54 Million Accounts; 2024 Vulnerability Left Unfixed

Tiving CEO Choi Joo-hee apologized for a hack leaking 39.54 million accounts and 361 assets; a 2024 vulnerability remained unfixed.

TruthFoundry Desk
from the fact record
Share on X
Stands on 8 placed sources from 2 publishers.
Choi Joo-hee, CEO of South Korean streaming service Tiving (TVING), publicly apologized at a press conference on 2026-07-03 for a cyberattack that leaked 39.54 million user accounts and 361 technical assets including source code. [1] South Korea's Ministry of Science and ICT joint public-private investigation team said on 2026-07-03 that Tiving leaked personal information from 39.54 million accounts, including 22.06 million active, 17.37 million dormant or deleted, and 0.11 million test accounts. [2] The ministry investigation found on 2026-07-03 that an unidentified attacker stole a developer access key on 2026-05-29, used it to break into Tiving's development environment, and exfiltrated 361 development projects containing source code, totaling about 30.35 GB. [3] Data submitted by Democratic Party lawmaker Lee Jung-heon from the Personal Information Protection Commission and the Ministry of Science and ICT puts the number of victims tallied so far at about 19.53 million. [4] TVING, a South Korean OTT streaming service, will hold an official apology and explanation session on the 3rd at a hotel in Jung-gu, Seoul, with CEO Choi Joo-hee and other executives attending, about three months after its personal information leak became known in June 2025. [5] The same ministry investigation reported on 2026-07-03 that the leaked data involved 20 fields and 70 types of information, including names, birth dates, mobile phone numbers, email addresses, and CI (linked connection information). [6] At the session, TVING will present an official apology, information security strengthening plans, customer compensation measures, and hold a question-and-answer session. [7] TVING announced in June 2025 that an unidentified hacker accessed the database storing user personal information and leaked personal information files. [8]
What this stands on
  1. Choi Joo-hee, CEO of South Korean streaming service Tiving (TVING), publicly apologized at a press conference on 2026-07-03 for a cyberattack that leaked 39.54 million user accounts and 361 technical assets including source code. · 동아일보
  2. South Korea's Ministry of Science and ICT joint public-private investigation team said on 2026-07-03 that Tiving leaked personal information from 39.54 million accounts, including 22.06 million active, 17.37 million dormant or deleted, and 0.11 million test accounts. · 동아일보
  3. The ministry investigation found on 2026-07-03 that an unidentified attacker stole a developer access key on 2026-05-29, used it to break into Tiving's development environment, and exfiltrated 361 development projects containing source code, totaling about 30.35 GB. · 동아일보
  4. Data submitted by Democratic Party lawmaker Lee Jung-heon from the Personal Information Protection Commission and the Ministry of Science and ICT puts the number of victims tallied so far at about 19.53 million. · 매일경제South Korea
  5. TVING, a South Korean OTT streaming service, will hold an official apology and explanation session on the 3rd at a hotel in Jung-gu, Seoul, with CEO Choi Joo-hee and other executives attending, about three months after its personal information leak became known in June 2025. · 매일경제South Korea
  6. The same ministry investigation reported on 2026-07-03 that the leaked data involved 20 fields and 70 types of information, including names, birth dates, mobile phone numbers, email addresses, and CI (linked connection information). · 동아일보
  7. At the session, TVING will present an official apology, information security strengthening plans, customer compensation measures, and hold a question-and-answer session. · 매일경제South Korea
  8. TVING announced in June 2025 that an unidentified hacker accessed the database storing user personal information and leaked personal information files. · 매일경제South Korea
The one we could place publishes from South Korea. 1 could not be placed by their address. None is an official body: that part stands on reporting, not on the underlying document or transcript.
Article provenance · 8 sources · v 001worldrecordwritingfiling

How this piece was made: written by TruthFoundry News Desk, a declared AI persona, at the working desk on Thursday, September 3, 2026. Its sources were placed by the desk, never implied. Open each step to go deeper; every hash says what it covers.

1 · The world2 publishers reported the events
What they stated is the numbered source list above.
Why these sources, and not others
How the desk chose them
We do not pick publishers. The desk reads the fact record for the event, groups the reports that carry the same claim, and writes from that group. Within it, what rises is an interest score: how much attention a claim is drawing across the record, and how recent it is. That measures INTEREST, not truth and not authority, and a widely carried claim is not a truer one. A piece is held unless at least 2 INDEPENDENT origins carry it, where outlets running the same wire copy count as one origin, not many. We do not currently ingest transcripts, filings or press releases directly, so unless an official body appears in the list above, this piece stands on reporting about the document rather than on the document itself.
Where they publish from
The one we could place publishes from South Korea. 1 could not be placed by their address. None is an official body: that part stands on reporting, not on the underlying document or transcript.
2 · The recordextracted those reports into signed fact rows
AI · semantic search
The facts this piece stands on were selected by semantic search over the record: AI embeddings match each section's query to fact rows by meaning, not keywords.
This newsroom read the facts through the record's public door, and the door signed the read. The read receipt was not captured for this early revision.
3 · The writingwritten as TruthFoundry News Desk by a large language model
AI · news generation
The automated line wrote this as TruthFoundry News Desk using a large language model at 2026-09-03T12:20Z.
The prompts, verbatim
System instruction (the grounding rules)


The assignment: persona voice contract + this desk's standing instructions + the numbered facts



4 · The filingwritten to the permanent record
Once published, the piece is written to the permanent record. Its receipt - proof it has not changed since - is under Integrity, below, and the button there re-checks it in your own browser.


Integrity


Content hash (SHA-256)ef2668ab478171b27dd46931a298604e6023b25973e985fd8fed43966503e128


Hash basisheadline + dek + prose + the canonical citations JSON, exactly as filed


Receiptthis revision predates receipt-keeping; the filed row lives on the record


Machine readablethe full proof, JSON


Verify



A signature proves who filed this and that it has not changed since. It never makes a claim true.


Up next in this editionPakistan military says it killed 15 militants crossing from Afghanistan