KT Corporation Fined $39 Million for Prolonged Data Breach in South Korea South Korea’s Personal Information Protection Commission (PIPC) has imposed a KRW 53.979 billion ($39 million) fine on KT Corporation, the country’s largest telecommunications provider, for severe data protection failures. The penalty follows a near-year-long breach from October 8, 2024, to September 5, 2025, during which attackers accessed the personal data of 16,647 subscribers. The attackers exploited a lost KT femtocell a small cellular base station by extracting its authentication certificate and deploying it on a rogue device. This allowed them to intercept cellular traffic, including phone numbers and authentication codes, leading to fraudulent mobile payments totaling KRW 240 million ($175,000) for at least 368 customers. The PIPC identified critical security lapses, including long-lived femtocell certificates and the absence of IP address restrictions, which facilitated the breach. Further investigation revealed that 38 KT servers were compromised by BPFDoor malware in March 2024, though the company allegedly failed to report the infection promptly and deleted logs from affected systems, obstructing the probe into potential additional data exposure. In response, the PIPC has ordered KT to enhance security measures and is exploring legislative changes to penalize evidence concealment. The incident underscores systemic vulnerabilities in telecom infrastructure and regulatory enforcement.