Platform companies hit by personal data breaches appeared before a parliamentary audit and acknowledged responsibility for weak security management, outlining plans to compensate customers and strengthen protections.
Choi Joo-hee, chief executive of streaming service Tving, appeared as a witness before the National Assembly's Science, ICT, Broadcasting and Communications Committee on the 6th. "As the person in charge, I apologize to the public, and I have come to fully realize that we were negligent on security," she said. Also present were Lim Han-wook, chief executive of Toss Payments, and Hong Seung-il, chief executive of Healing Paper.
Rep. Lee Jung-heon of the Democratic Party of Korea criticized Choi, saying developer access credentials had been left in plain text in the source code rather than encrypted. "While 24 gigabytes flowed out through a virtual server, there was no monitoring, and you broke the law by filing a report more than 24 hours late," he said. Tving suffered a large-scale breach in May that exposed personal information from 39.54 million accounts.
Rep. Lee Hoon-ki of the Democratic Party said that while Tving's revenue grew 26-fold over the past five years, from 15.5 billion won to 406.8 billion won, the company had only four employees dedicated to information protection. "The structure made an incident inevitable, because they focused only on making money and growing while extremely neglecting security investment," he said.
Choi responded that the company had failed to properly examine whether its spending on information protection was sufficient as the business expanded rapidly. "We will sharply increase staffing and investment to raise our security to a global standard based on Zero Trust," she said.
Rep. Hwang Jung-ah of the Democratic Party also criticized the company, saying Tving had caused the largest security incident on record yet was refusing to submit documents on the grounds that an investigation was under way. "A large company is doing worse than small and mid-sized firms," she said. Bae Kyung-hoon, deputy prime minister and minister of science and ICT, said there was a need to respond firmly to cases in which document submission was not made in good faith.
Senior executives from other platform companies that have suffered hacking or data leaks were summoned one after another at the audit. They faced concentrated questioning over inadequate security management and also pledged measures to prevent recurrence, including relief for victims and expanded security investment.
At Toss Payments, an incident in September exposed 4,131 payment records belonging to 2,671 customers of merchants using its payment gateway service. Rep. Lee Jung-heon said the company's system for detecting abnormal signs had failed to work in the mass leak of payment receipts.
"We judged that there were shortcomings and are carrying out improvements," Lim said. Specifically, he said the company was "providing cash-equivalent gift certificates to merchants and others to compensate for damages, and strengthening management and supervision of merchants as well as reviewing internal systems."
Hong Seung-il, chief executive of Healing Paper, which operates the medical beauty platform Gangnam Unni, also attended the audit. Hwang told Hong that sensitive medical data had been exposed, including 1 million records related to procedures and 6,000 URLs for consultation photos. "Even after recognizing the attack, you left the photo URLs open for anyone to view, and you did not properly obtain consent for sensitive information," she said.
On relief for victims, Hong said the company would "pursue compensation and legal support for secondary damage caused by the leak of sensitive information, and operate a dedicated counseling center along with 50,000 points in compensation." As measures to prevent a recurrence, he pledged to "expand security staff more than threefold and increase security investment 2.5-fold."
