Korean platform CEOs apologize at parliamentary audit over data leaks
In short
The heads of TVING, Toss Payments and Gangnam Unni operator Healing Paper were summoned as witnesses to the National Assembly's Science, ICT, Broadcasting and Communications Committee audit on Oct 6 and were criticized over poor security management in recent hacking and data-leak incidents. Each acknowledged shortcomings and apologized, promising compensation and bigger security budgets. Asia Economy also reported questions to LG Uplus over alleged hacking concealment and remarks by the science minister on penalty waivers.
Read the full story 2 min read
The chief executives of three Korean platform companies were summoned as witnesses to the National Assembly's Science, ICT, Broadcasting and Communications Committee audit on Oct 6 and were criticized over poor security management, according to Yonhap and Asia Economy. The witnesses were TVING CEO Choi Joo-hee, Toss Payments CEO Lim Han-wook and Healing Paper CEO Hong Seung-il, whose company operates the Gangnam Unni app. [ 1 , 2 ]
Choi apologized, saying she felt keenly that the company had neglected security and that, as the responsible person, she was sorry to the public, both outlets reported. Yonhap reported that Rep. Lee Jung-heon of the Democratic Party told the hearing that 39.54 million TVING accounts and source code had been taken, that developer access credentials were left in plaintext without encryption, that 24 gigabytes left through a virtual server without monitoring, and that the report was delayed beyond 24 hours in violation of the law. Choi acknowledged management negligence and said affected customers had received phishing-prevention measures and point coupons for entertainment services, Yonhap reported. Asia Economy reported her as adding that the company would raise staffing and investment to bring security to a global level based on zero trust. [ 1 , 2 ]
Toss Payments was questioned over a mass leak of payment receipts and an anomaly-monitoring system that did not work, according to both outlets. CEO Lim Han-wook said there had been shortcomings, that cash-equivalent gift certificates were being given to merchants as relief, and that the company was both reviewing internal systems and strengthening management and oversight of merchants, Yonhap and Asia Economy reported. [ 1 , 2 ]
Hong Seung-il apologized over the leak of sensitive information of about 220,000 people in 103 countries, including treatment-hope body parts, purchased products and photographs, the two outlets reported. Asked about the incident occurring despite the company receiving ISMS certification in 2024, Hong said the shortcomings of its prevention system were felt acutely and that the company would expand security staff more than threefold and security investment 2.5 times, Yonhap reported. He also promised 50,000 points in compensation, legal support costs for secondary damages from the sensitive-data leak and a dedicated counseling center, according to both outlets. [ 1 , 2 ]
Asia Economy additionally reported that LG Uplus, which faces allegations of concealing a hacking incident, was questioned over whether it properly preserved server originals and forensic data. Rep. Han Jun-ho of the Democratic Party asked about an operating-system reinstallation after the company was notified of intrusion signs by the Korea Internet and Security Agency, and about when forensic images were created and whether originals were kept, according to the report. Deputy Prime Minister and Science Minister Bae Kyung-hoon was quoted as saying that if deliberate evidence destruction or obstruction of an investigation is revealed, a penalty exemption should be requested, and that the government would actively work to have penalty waivers applied when serious service failures or core contractual breaches are uncovered. [ 2 ]
Why it matters
The session puts the handling of major consumer data breaches by Korean platforms under formal parliamentary scrutiny, with lawmakers pressing on monitoring failures, delayed reporting and evidence preservation. The companies' promises of compensation, legal support and larger security budgets, and the government's stated willingness to apply penalty waivers for serious contract violations, indicate the issue may carry regulatory follow-up. The documents do not state any decision beyond these statements.
Key facts
- The National Assembly's Science, ICT, Broadcasting and Communications Committee questioned platform executives over recent hacking and data-leak incidents at its Oct 6 audit. [ 1 , 2 ]
- TVING CEO Choi Joo-hee apologized, saying she felt keenly that the company had neglected security, and said it would increase staff and investment toward global-standard, zero-trust-based security. [ 1 , 2 ]
- Rep. Lee Jung-heon of the Democratic Party said 39.54 million TVING accounts and source code were taken, developer credentials were left in plaintext, 24 gigabytes left through a virtual server without monitoring, and the report was delayed beyond 24 hours in violation of the law. [ 1 ]
- Toss Payments CEO Lim Han-wook said there had been shortcomings, that cash-equivalent gift certificates were being given to merchants as relief, and that internal checks and oversight of merchants were being strengthened. [ 1 , 2 ]
- Healing Paper CEO Hong Seung-il apologized after sensitive information of about 220,000 people in 103 countries, including treatment-hope body parts, purchased products and photos, was leaked. [ 1 , 2 ]
- Hong said the company would expand security staff more than threefold and security investment 2.5 times, and offer 50,000 points, legal support for secondary damages and a dedicated counseling center. [ 1 , 2 ]
- Asia Economy reported that LG Uplus faced questions over whether it properly preserved server originals and forensic data after being notified of hacking signs. [ 2 ]
- Deputy Prime Minister and Science Minister Bae Kyung-hoon said the government would actively push for penalty waivers to be applied when serious service failures or core contractual breaches are found. [ 2 ]
Confirmed by several sources
- CEOs of platforms that suffered recent hacking or data leaks were summoned as witnesses to the National Assembly audit and were criticized over poor security management. [ 1 , 2 ]
- TVING CEO Choi Joo-hee apologized at the Oct 6 audit, acknowledging that security had been neglected. [ 1 , 2 ]
- Toss Payments CEO Lim Han-wook acknowledged shortcomings, said cash-equivalent gift certificates were being provided to merchants as relief and that internal checks and merchant oversight were being strengthened. [ 1 , 2 ]
- Healing Paper CEO Hong Seung-il apologized over the leak of sensitive data of about 220,000 people in 103 countries and promised more security staff and investment, 50,000 points in compensation, legal support and a dedicated counseling center. [ 1 , 2 ]
- Democratic Party lawmaker Lee Jung-heon questioned the executives, including over TVING's leak and Toss Payments' failure to detect anomalies. [ 1 , 2 ]
Still unclear
- Whether TVING's system left developer access credentials unencrypted and whether 24 gigabytes left through a virtual server without monitoring These figures and technical details come from a lawmaker's questioning reported by Yonhap; TVING's CEO acknowledged management negligence but the documents do not give a company confirmation of the specific technical claims.
- Whether LG Uplus had hacking signs to conceal or mishandled forensic evidence, and how it responds Only Asia Economy reports the questions from Rep. Han Jun-ho about server OS reinstallation and forensic image timing; the documents contain no response from LG Uplus.
- Whether the government will actually apply penalty waivers in any specific case Asia Economy quotes the science minister stating the government's position, but the documents do not say a penalty waiver has been decided or applied.
What local media are saying
Timeline, local time
- On Oct 6 Yonhap reports that TVING, Toss Payments and Gangnam Unni operator Healing Paper executives were summoned to the National Assembly audit and criticized over security management. [ 1 ]
- On Oct 6 Asia Economy reports the same session, adding questions to LG Uplus over alleged hacking concealment and the science minister's comments on penalty waivers. [ 2 ]