South Korea Forces Telecom Giants to Remove Unfair Liability Clauses After Major Data Breaches South Korea’s Korea Fair Trade Commission (KFTC) has ordered the country’s three dominant mobile carriers SK Telecom, KT, and LG Uplus to remove four categories of unfair clauses from their standard customer contracts. The ruling, issued on Thursday, targets provisions that previously shielded carriers from legal responsibility in cases of data breaches or negligence, marking a significant shift in consumer protections for the nation’s 55 million mobile subscribers. ### Key Findings and Contract Changes The KFTC’s review identified four types of clauses that violated Korea’s Terms and Conditions Act, which prohibits standard-form contracts from unreasonably limiting a business’s liability: 1. Blanket Data-Breach Immunity – All three carriers had clauses absolving themselves of liability for breaches, particularly those involving wireless LAN systems or private telephone exchanges. The KFTC ruled that carriers cannot contractually transfer security risks to subscribers and must now be held liable in proportion to their negligence. 2. Credential Security Shifted to Users – One carrier’s contract held subscribers fully responsible for unauthorized account use while capping the carrier’s liability to cases of gross negligence. The KFTC rejected this, affirming that carriers bear the burden of proving they were not at fault under Korea’s data protection laws. 3. All-or-Nothing Fault Elimination – Carriers previously included clauses stating that if a service disruption was partly caused by subscriber conduct, the carrier bore zero liability. The KFTC ruled that damages must be apportioned based on each party’s degree of fault, preventing carriers from evading responsibility entirely. 4. Silence as Consent to Contract Changes – One carrier’s contract deemed subscriber inaction as acceptance of amendments. The KFTC voided this practice unless carriers provide clear, prominent notice that silence within a reasonable period constitutes agreement. ### Regulatory Pressure in the Wake of Major Breaches The ruling arrives amid heightened scrutiny of South Korea’s telecom sector, following a series of high-profile security failures: - SK Telecom’s USIM Breach – In April 2025, malware in SK Telecom’s network exfiltrated USIM authentication data for 26.96 million subscribers (nearly half the population). Investigators found the company stored 26.1 million USIM keys unencrypted, used plaintext admin credentials, and ignored security patches dating back to 2016. The Personal Information Protection Commission (PIPC) fined SK Telecom ₩134.8 billion ($94 million) the largest telecom privacy penalty in Korean history while the Consumer Dispute Settlement Commission later ruled the carrier could owe up to ₩2.3 trillion ($1.61 billion) in per-user compensation. - KT’s Evidence Deletion – KT faced allegations of deleting server evidence during an investigation into a separate breach. - LG Uplus’s Server Wiping – LG Uplus was accused of wiping servers before regulators could examine them. The KFTC’s action adds a consumer contract dimension to these enforcement efforts, removing the legal loopholes carriers could previously exploit to avoid liability. ### Market Impact and Broader Enforcement Trends South Korea’s telecom market is highly concentrated, with SK Telecom, KT, and LG Uplus serving nearly all 55 million subscribers. The KFTC noted that the lack of competitive alternatives left consumers with no choice but to accept the carriers’ unfair terms. The ruling ensures that future breaches will no longer be shielded by contractual waivers, providing subscribers with clearer legal recourse for damages. The decision aligns with a broader crackdown on unfair standard-form contracts. In 2024, the KFTC handled 168 such cases 50% more than in 2023 targeting sectors from webtoons to e-commerce. However, the telecom ruling carries the highest stakes, given the industry’s scale and the sensitivity of the data involved. ### Global Contrast: US Lacks Equivalent Protections The KFTC’s action highlights a regulatory gap in the U.S., where mobile carriers routinely include limitation-of-liability clauses in contracts. While the FCC’s 2023 breach notification rules require disclosure, no federal regulator has compelled carriers to remove such waivers. State laws vary, but no systematic review akin to Korea’s has been conducted at the national level. ### Future Implications South Korea’s amended Personal Information Protection Act, set to take effect on September 11, 2026, will raise the maximum administrative fine for serious violations from 3% to 10% of a company’s annual revenue. While the new penalties won’t apply retroactively to past breaches, they will govern future incidents, increasing pressure on carriers to bolster security measures. The KFTC’s ruling is prospective, meaning it applies to future breaches and contract disputes. However, ongoing compensation claims from the 2025 SK Telecom breach will proceed through separate regulatory and civil channels. For subscribers, the changes remove a major legal barrier, making it easier to hold carriers accountable for negligence.

LG Uplus, a major South Korean mobile carrier, reported a possible data breach after a U.S. cybersecurity outlet, Phrack, claimed a hacking group infiltrated its internal network. The breach allegedly involved the compromise of 8,938 servers, 42,256 accounts, and 167 employees' data. While LG Uplus initially denied any evidence of a breach following an internal inspection in August, the company later filed a proactive report to the Korea Internet and Security Agency (KISA) to address public concerns and potential misunderstandings. The incident was disclosed after the company’s president, Hong Bum-shik, mentioned it during a parliamentary audit, emphasizing the need for transparency despite the lack of confirmed data exfiltration. The breach, if validated, could expose sensitive internal employee data and customer account information, raising significant operational and reputational risks.

LG Uplus, a major South Korean telecommunications provider, reported a suspected data breach to the national cybersecurity agency (KISA) after potential compromise signs were detected in July. While the company initially denied a breach in August, an unverified report by Phrack magazine claimed hackers—allegedly linked to China or North Korea—stole data from nearly 9,000 LG Uplus servers. The incident remains under investigation, with no confirmed details on the scope, source, or whether customer/employee data was exposed. However, the breach follows a pattern of escalating cyberattacks targeting South Korea’s telecom sector, raising concerns about national digital infrastructure resilience and the sector’s vulnerability to state-sponsored or sophisticated threat actors.The breach coincides with similar incidents at SK Telecom and KT Telecom, suggesting a coordinated campaign against critical communications networks. If confirmed, the compromise could undermine public trust in telecom security, disrupt services, or expose sensitive subscriber data—potentially affecting millions of users. The lack of transparency and delayed disclosure further exacerbate risks, highlighting systemic gaps in South Korea’s cybersecurity framework. Authorities have not ruled out financial, reputational, or operational damage, though the full impact remains unclear pending investigation results.

KT Corporation Fined $39 Million for 11-Month Data Breach in South Korea South Korea’s Personal Information Protection Commission (PIPC) has imposed a KRW 53.979 billion ($39 million) fine on telecommunications giant KT Corporation for severe data protection failures that led to an 11-month-long network compromise between October 8, 2024, and September 5, 2025. The breach came to light on September 10, 2025, after customers reported fraudulent micropayments. KT initially disclosed that 5,500 users were affected, but the PIPC’s investigation revealed the exposure of 16,647 subscribers’ personal data, resulting in KRW 240 million ($167,400) in fraudulent mobile payments for at least 368 victims. ### How the Breach Occurred The attack stemmed from a compromised femtocell a small cellular base station used to extend network coverage. Attackers obtained a valid authentication certificate from the lost device and installed it on a rogue femtocell, tricking nearby devices into connecting. This allowed them to intercept mobile traffic, including phone numbers, IMSI, and IMEI identifiers, and later capture SMS and ARS authentication codes used for micropayments. The PIPC found KT’s security measures severely lacking: - Femtocell certificates remained valid for 10 years without renewal. - Connections were not restricted by source IP addresses. - A bypass route allowed attackers to evade the femtocell management server. ### Additional Security Failures The investigation also uncovered a separate malware infection in March 2024, affecting 38 KT servers. The malware, BPFDoor a stealthy Linux/Solaris backdoor linked to the China-nexus Red Menshen group enabled attackers to monitor network traffic covertly using Berkeley Packet Filter (BPF) technology. Despite detecting the infection, KT failed to report it and later deleted logs from compromised servers, hindering the PIPC’s ability to assess the full scope of the breach. ### Regulatory Response In addition to the fine, the PIPC ordered KT to: - Strengthen femtocell and network security controls. - Improve governance over personal data protection. - Ensure its Chief Privacy Officer has meaningful oversight. - Expand ISMS-P certification to cover mobile network systems. The Commission also announced plans to push for legislative changes, including stricter penalties for companies that conceal or destroy evidence during investigations. The case follows a similar incident at LG U+, where logs were wiped before authorities could fully assess the breach.