[National Assembly Audit] Tving, Toss Payments face breached security systems — 39.54 million records leaked, with just four dedicated staff

South Korea’s leading platform companies came under fire in a National Assembly audit over serious lapses in security management. Executives from 'Tving', 'Toss Payments' and 'Gangnam Unnie', all recently hit by large-scale hacking and personal-data breaches, apologized in unison. But the hearings exposed security investments that were woefully inadequate compared with their explosive growth.

Tving had four security staff as revenue jumped 26-fold — a disaster waiting to happen

Tving CEO Choi Joo-hee appeared before the National Assembly’s Science, ICT, Broadcasting and Communications Committee on Oct. 6 and apologized for the massive leak of accounts and source code. According to Rep. Lee Jung-heon of the Democratic Party, Tving left developer access credentials in plain text without encryption as 39.54 million accounts and critical source code were stolen. Although 24GB of data was siphoned out through a virtual server, the company’s internal monitoring system failed to detect it, and delayed reporting beyond the statutory deadline worsened the fallout.

Rep. Lee Hoon-ki of the Democratic Party sharply criticized Tving’s lopsided growth. Over the past five years, revenue soared 26.2-fold, from 15.5 billion won to 406.8 billion won, while the company had only four 'dedicated information-security staff'. Lawmakers also faulted Tving for failing to take fundamental action after a 2024 simulated hack had already identified vulnerabilities. Choi said, "We failed to scrutinize security investments closely enough during our growth," and pledged to build a global-standard security system based on 'zero trust'.

220,000 pieces of sensitive medical data leaked as companies scramble after the fact

Toss Payments, which suffered a mass leak of payment receipts, also came under fire for inadequate 'anomaly monitoring'. CEO Lim Han-wook acknowledged gaps in the management system and proposed stronger oversight of affiliated merchants and compensation through cash-equivalent gift certificates.

Hong Seung-il, CEO of Healing Paper, which operates the aesthetic medical platform Gangnam Unnie, also accepted responsibility for a more damaging leak of 'sensitive medical data'. The incident exposed without adequate safeguards the desired treatment areas, purchased services and photos of more than 220,000 people in 103 countries. It even raised questions about the effectiveness of 'ISMS (Information Security Management System)' certification. Rep. Hwang Jung-ah of the Democratic Party pointed to the fact that photo URLs remained publicly accessible even after the attack was detected, as well as flaws in the consent process for sensitive information.

Hong pledged to triple the company’s security staff and increase related investment 2.5-fold. He also unveiled a dedicated counseling center for compensation related to secondary damages, legal assistance and a 50,000-point compensation package. But analysts expect it will be difficult to restore trust in the already damaged platform in the short term.