Tving prices its data breach at 10,000 won of points and coupons per customer

The arithmetic behind the advertised value is worth doing. The redeemable part of the package is 5,000 won in Tving points, redeemable against new movie purchases, plus one coupon: either a one-month Wavve ad-supported subscription valued at 5,500 won or a 5,000-won CGV combo discount ^[9]. Depending on the choice, that is 10,000 or 10,500 won ^[1]. Jang Hyeon-gyeong, who runs Tving's business management division, put the average customer's total benefit at about 20,000 won ^[10]. The other 10,000 won is the insurance premium and a viewing upgrade ^[2], and the upgrade is Tving's own inventory: up to 4K resolution, four concurrent devices and 400 offline downloads, applied automatically from next month through November with no application required ^[8]. Entitlement flags and bandwidth cost Tving less than the same figure paid out in cash.

The insurance is the only component that pays on a loss, and its cap is 300 times the redeemable points and coupons ^[3]. Its term is twelve months, ending in September next year ^[7]. Fraud built on leaked identity records can still occur after that one-year term runs out.

Ko Min-seok, executive vice president for human resources, gave the most useful number of the briefing when he put the current security function at 9.4 people, 4.8 internal and 4.6 external ^[14]. Net of that base, the five-year plan adds 16 to 21 people ^[4]. It also splits security into product, cloud, enterprise IT and compliance ^[13], which lands at roughly six to eight people per discipline at the top of the range ^[5]. That is the team scheduled to deliver the zero-trust rebuild: authentication and access checks at every stage, permissions scoped to need, and systems and network segments isolated on the assumption that internal breaches happen ^[16].

The money is a 2030 endpoint rather than this year's budget. Choi Joo-hee said the target represents about four times the level of the previous five years ^[12]. Read against annual spending, that puts the current base near 3 billion won a year ^[6].

What the account of the briefing does not carry is scope. It includes no user count, no intrusion vector and no named actor, only Tving's statement that it accepts the public-private joint investigation team's findings ^[17]. Without a user count, the total bill for the package cannot be derived from the per-customer figure ^[8]. What can be set against another company's numbers is exactly what Tving published: value per customer, spend per year, headcount at the end of a ramp.