KT Corp. Faces Sanctions Over 2023 Data Breach Linked to Illegal Femtocell Attack South Korea’s Personal Information Protection Commission (PIPC) will decide on July 29 whether to impose sanctions on KT Corp. following a 2023 data breach caused by an illegal small-cell base station attack. The plenary meeting will determine if KT violated the Personal Information Protection Act (PIPA) and whether administrative fines will be levied. The breach, detected in September 2023, exposed personal data tied to 22,227 KT subscriber lines, including IMSI numbers, IMEI numbers, and phone numbers. Among the affected users, 368 victims experienced 777 unauthorized micropayment transactions totaling approximately 243 million won ($180,000 USD). The PIPC has also investigated KT’s response to a separate BPFDoor malware infection on its servers. During deliberations, the commission will assess whether KT implemented adequate technical and administrative safeguards, as well as its compliance with breach reporting and notification requirements. Under PIPA, companies failing to protect personal data may face fines of up to 3% of relevant revenue. Based on KT’s average wireless service revenue of 6.4955 trillion won over the past three years, the maximum potential fine could reach 194.8 billion won ($143 million USD). However, the final amount will depend on factors such as the severity of the breach, the scale of damages, and KT’s incident response. A decision is expected on July 29, though delays are possible if further review is needed. Previous cases involving SK Telecom and Coupang saw corrective measures approved on the same day as the plenary review.