Key Takeaways
Korean lawmakers sharply questioned Tving, Toss Payments, and Gangnam Unni over recent hacking and data leak incidents.
The biggest criticism was that rapid business growth far outpaced security staffing, monitoring, and incident response.
The companies apologized and promised fixes, but the column argues that trust will only return when security becomes part of daily operations, not a post-breach response.
Nearly 39.54 million accounts, sensitive data from more than 220,000 people, and a harsh parliamentary grilling. Those numbers make clear this was not a routine mishap.
At a National Assembly audit, the cases involving Tving, Toss Payments, and Gangnam Unni laid bare a hard truth for South Korea's platform industry: winning users is easy to celebrate, but protecting the information they entrust to a service is still treated too late.
Security is too costly, socially, to be left as a line item that only matters after a breach. Once personal data leaks, no coupon or reward point can truly take it back.
Growth raced ahead of security
Tving, the streaming platform operated by CJ ENM, was the first company under fire. Chief executive Choi Joo-hee apologized and said she felt deeply responsible for the lapse in security. Lawmakers said 39.54 million account records and source code had been leaked, developer access credentials were left in plaintext rather than encrypted, 24 gigabytes of data were siphoned off through a virtual server, and the company failed to report the incident within the legal deadline.
What made the criticism sting more was Tving's growth story. Over the past five years, revenue surged from 15.5 billion won to 406.8 billion won, a 26.2-fold increase. But the company reportedly had only four dedicated information security staff members. The column's point is blunt: if a platform scales quickly, security must scale with it. By the numbers, Tving's business engine was running flat out while its engine room remained too exposed.
To be fair, companies often say that during a rapid expansion phase, development, marketing, and content spending naturally take priority. Yet a platform that stores account, payment, usage, and sometimes health-related data is no longer just a private business. It carries a public responsibility. Tving said it would strengthen a zero-trust security framework, but the real test is not a promise. Security depends on steady staffing, daily checks, and a culture that treats protection as essential rather than optional.
Data leaks hurt long after the apology
Toss Payments was criticized for a large-scale leak of payment receipts after its anomaly detection system reportedly failed to work. The company admitted shortcomings and said it would provide cash-equivalent gift certificates to affected merchants while reviewing internal controls and tightening oversight. Even so, a breach of payment data is never just a technical failure. Payment information maps directly onto everyday life, and everyday life reveals the outline of privacy itself.
Gangnam Unni, a beauty and medical concierge platform, faced even more sensitive scrutiny. Lawmakers said data tied to treatment preferences, payment products, and photos had been leaked from users in 103 countries, affecting more than 220,000 people. They also said one million pieces of procedure-related data and about 6,000 consultation photo URLs were exposed. The most troubling detail was that the photo URLs remained publicly accessible even after the attack was recognized, turning the incident into a question of management responsibility, not just external hacking. Possessing an information security management certification did not absolve the company.
Chief executive Hong Seung-il said he deeply regretted failing to protect sensitive personal information. He promised to more than triple the security staff, raise security investment by 2.5 times, offer 50,000 reward points, and operate a dedicated counseling center. But the emotional damage caused by leaked medical and treatment information cannot be measured in points. A user's concerns about body areas, consultation photos, and medical preferences can linger far longer than any coupon can possibly compensate.
Certification is not the same as real operation
The real significance of the audit was not simply that lawmakers scolded a few companies. Their repeated question was about actual operations, not paperwork. If vulnerabilities were already pointed out in a 2024 mock hacking exercise, why were they not fully removed? Why did anomaly detection fail? Why was the notice delayed? The column argues these are not just technical mistakes but failures of attitude.
Platform companies often give the same defense: users grow fast, features multiply, partnerships expand, and the organization gets pulled into a race for speed. But when speed becomes the only goal, security teams are pushed to the back of the line. That pattern is what surfaced here. Tving's four-person security team, Gangnam Unni's slow response, and Toss Payments' failed monitoring system may look like separate cases, but they point to the same question: why are platforms that collect so much data not expanding their defenses at the same pace?
South Korea needs prevention, not cleanup
The companies all promised to prevent repeat incidents. More staff, more investment, compensation, and customer support centers are all necessary. But these are also after-the-fact repairs. Real change has to happen before the next breach. That means applying the principle of least privilege, encrypting sensitive administrative information, automatically blocking unusual activity, and actually fixing the vulnerabilities that surface in outside audits. The stricter standard should apply especially to platforms handling medical, payment, and streaming data.
The harsh parliamentary criticism should not end as performative outrage. Platform companies in South Korea are now part of daily infrastructure. More people use them, and more sensitive information is entrusted to them. That means the weight of responsibility has to change too. In this era, trust belongs not to the company that grows fastest, but to the one that can protect user data to the end. This audit reminded the industry of that basic rule. If platforms keep bragging only about growth, they will keep ending up in the same hearing room, facing the same questions with different names on the docket.
