AI-Based Hacking Causes Massive Data Breach at Tving

Thumbnail Image

The information displayed in the AIM should not be reported as representing the official views of the OECD or of its member countries.

Tving, a South Korean streaming service, suffered a major data breach exposing nearly 40 million personal records, with its CEO attributing the incident to suspected AI-based hacking. Authorities are investigating, and the Personal Information Protection Commission plans to conclude its probe and impose penalties by year-end.[AI generated]

Why's our monitor labelling this an incident or hazard?

The CEO of Tving explicitly states that the hacking is presumed to be AI-based, indicating the involvement of an AI system in the attack. The data breach has already occurred, causing harm through the exposure of personal data, which is a violation of privacy rights and applicable law. This meets the criteria for an AI Incident because the AI system's use (in the hacking) has directly led to harm (violation of rights and breach of law). The investigation and potential sanctions are responses to this incident, not the primary event. The Google Korea data leak is unrelated to AI and thus does not affect the classification.[AI generated]
AI principles
Privacy & data governanceRespect of human rights
Industries
Media, social platforms, and marketingDigital security
Affected stakeholders
ConsumersBusiness
Harm types
Human or fundamental rightsEconomic/PropertyReputational
AI system task:
Other

Articles about this incident or hazard