Tving, the Korea online video service (OTT) run by CJ ENM, is expected to face a penalty surcharge over a personal information leak.
As calls grow for sanctions over the personal information leak, some say a penalty surcharge could further burden Tving, whose financial strain has deepened due to large losses and dwindling cash.
According to the OTT industry on the 12th, the Personal Information Protection Commission began investigating last week the personal information leak that occurred at Tving. After the investigation ends, it will decide whether to impose a penalty surcharge. The exact scale of damage has not been finalized, but given that Tving has 13 million paid and free members, the prevailing view is that it will be hard to avoid a penalty surcharge.
An official at the Personal Information Protection Commission said, "We have only just begun the investigation, so it is hard to specify when it will conclude," and noted, "The number of personnel assigned varies by case, so each investigation period differs."
On the 3rd, Tving announced that an unidentified hacker broke into its databases (DB) and leaked user personal information. In addition to user IDs, names, dates of birth, gender, CI (connection information), DI (duplicate subscription verification information), mobile phone numbers (last four digits encrypted), email addresses (ID part encrypted, excluding domain), refund account numbers (encrypted), and passwords (one-way encrypted) were leaked.
If Tving is hit with a penalty surcharge over the incident, its financial burden is also expected to grow. Tving's cumulative net loss from 2020 to last year reached about 507.7 billion won. As it invested 169.6 billion won in intangible assets such as content licenses last year, cash and cash equivalents also fell sharply. Cash and cash equivalents, which were 101.3 billion won at the end of 2023, dropped to 14.3 billion won last year.
Its liability ratio is also rising. As of the end of last year, the liability ratio stood at 140.1%. The ratio, which was 64.5% at the end of 2021, surpassed 100% for the first time in 2024 as cumulative losses piled up and then climbed to 140% last year. In addition, it had 20 billion won in short-term borrowing fund as of the end of last year. As there was no short-term borrowing fund at the end of 2024, reliance on external funding has also increased.
Industry attention is focused on the size of the penalty surcharge Tving may face. Under the current Personal Information Protection Act, if a personal information leak occurs, a penalty surcharge of up to 3% of revenue can be imposed. Applying 3% to Tving's revenue of 405.9 billion won last year puts the maximum penalty surcharge at about 12.1 billion won.
However, the amount of the penalty surcharge varies depending on the scale of the leak, the sensitivity of the information, and the degree of the company's negligence. Coupang, which caused a personal information leak, was hit with 624.681 billion won, equal to 1.5% of last year's revenue (45.5 trillion won), as a penalty surcharge.
Criticism of Tving is intensifying. Floor spokesperson Lee Ju-hee of the Democratic Party of Korea said on the 10th that it was "the complacency of corporations that treat security merely as an expense and slap-on-the-wrist punishments," and added, "Tving should face the most stringent level of penalty surcharge and sanctions set by the current Personal Information Protection Act."
An OTT industry official said, "OTT operators tend to be judged by content competitiveness and subscriber numbers, so investment priorities tend to concentrate on securing content."
The official added, "Investments in security systems tend to be seen as an expense because their effects are not readily visible until an incident occurs," and said, "We will have to wait for the Personal Information Protection Commission's findings to see whether Tving's level of security investment and its internal control system were appropriate."
Tving said it "implemented necessary response measures after confirming the incident and is faithfully cooperating with investigations by the government and relevant agencies."