Tving

A stolen developer access key let an unidentified hacker into Tving's internal systems, exposing 39.54 million accounts and 361 technical assets, including source code, before the data moved to overseas accounts that investigators still haven't traced. That single key was the trust boundary for the entire platform, not just one developer's corner of it. A developer's credential was never built to double as a perimeter. Tving caught the intrusion on May 30 but didn't report it until June 1, turning a breach into a fine as well.