South Korea’s Ministry of Science and ICT (MSIT) said Thursday that attackers stole information tied to 39.54 million Tving accounts and 361 development projects containing source code, after gaining access to the streaming platform’s development and production systems. The exposed accounts included 22.06 million active accounts, 17.37 million dormant or withdrawn accounts and about 110,000 test accounts, although the total includes duplicates and some users held as many as 13 accounts.

MSIT found that Tving stored production access keys in source code or plaintext, gave all developers access to every development project and failed to correct a hard-coded credential vulnerability