SK Telecom Gains 340,000 Customers After KT’s Data Breach Fallout In January, South Korea’s largest mobile carrier, SK Telecom, saw a surge of 342,000 new customers through mobile number portability (MNP) an 184.7% increase from December amid fallout from a major KT Corp. data breach. Industry data from the Korean Telecommunications Operators Association revealed that 221,000 of the new subscribers migrated from KT, a sharp rise from just 45,000 the previous month. KT, the country’s second-largest carrier, had waived early termination fees for two weeks starting December 31 as part of a compensation package following a September data breach that led to unauthorized micropayments. The breach eroded customer trust, prompting a mass exodus to competitors. Meanwhile, LG Uplus, South Korea’s third-largest operator, also benefited, gaining 183,000 MNP users a 102.3% month-over-month increase including 80,000 from KT. Despite the losses, KT’s own MNP inflows grew 53.2% to 121,000 users in January, though the net impact remained negative. The shift underscores the financial and reputational consequences of data breaches in highly competitive markets, with customers prioritizing security in their choice of mobile providers.

KT Corporation Fined $39 Million for 11-Month Data Breach in South Korea South Korea’s Personal Information Protection Commission (PIPC) has imposed a KRW 53.979 billion ($39 million) fine on telecommunications giant KT Corporation for severe data protection failures that led to an 11-month-long network compromise between October 8, 2024, and September 5, 2025. The breach came to light on September 10, 2025, after customers reported fraudulent micropayments. KT initially disclosed that 5,500 users were affected, but the PIPC’s investigation revealed the exposure of 16,647 subscribers’ personal data, resulting in KRW 240 million ($167,400) in fraudulent mobile payments for at least 368 victims. ### How the Breach Occurred The attack stemmed from a compromised femtocell a small cellular base station used to extend network coverage. Attackers obtained a valid authentication certificate from the lost device and installed it on a rogue femtocell, tricking nearby devices into connecting. This allowed them to intercept mobile traffic, including phone numbers, IMSI, and IMEI identifiers, and later capture SMS and ARS authentication codes used for micropayments. The PIPC found KT’s security measures severely lacking: - Femtocell certificates remained valid for 10 years without renewal. - Connections were not restricted by source IP addresses. - A bypass route allowed attackers to evade the femtocell management server. ### Additional Security Failures The investigation also uncovered a separate malware infection in March 2024, affecting 38 KT servers. The malware, BPFDoor a stealthy Linux/Solaris backdoor linked to the China-nexus Red Menshen group enabled attackers to monitor network traffic covertly using Berkeley Packet Filter (BPF) technology. Despite detecting the infection, KT failed to report it and later deleted logs from compromised servers, hindering the PIPC’s ability to assess the full scope of the breach. ### Regulatory Response In addition to the fine, the PIPC ordered KT to: - Strengthen femtocell and network security controls. - Improve governance over personal data protection. - Ensure its Chief Privacy Officer has meaningful oversight. - Expand ISMS-P certification to cover mobile network systems. The Commission also announced plans to push for legislative changes, including stricter penalties for companies that conceal or destroy evidence during investigations. The case follows a similar incident at LG U+, where logs were wiped before authorities could fully assess the breach.

KT Corp Fined $40M for Concealing Data Breach Affecting 16,600 Subscribers South Korea’s Personal Data Protection Commission (PDPC) has imposed a 54 billion won ($40 million) fine on telecom giant KT Corp for failing to disclose a data breach that exposed the personal and payment information of over 16,600 mobile subscribers. The breach, which occurred between 2024 and 2025, enabled hackers to make illegal payments totaling 240 million won ($178,000) using stolen customer data. During its investigation, the PDPC discovered malicious software on KT’s servers and determined that the company attempted to conceal the intrusion, violating legal requirements for prompt breach reporting. KT has not publicly responded to requests for comment. The case highlights regulatory scrutiny on data protection in the telecommunications sector, particularly the obligation for swift incident disclosure to mitigate further risks. The fine underscores the consequences of non-compliance with breach notification laws in South Korea.