SK Telecom Lawsuit to Overturn Record Fine for USIM Data Breach Disclosure Delays

SK Telecom filed a lawsuit with the Seoul Administrative Court seeking to revoke a record 135 billion won (US$91 million) penalty imposed by South Korea’s Personal Information Protection Commission (PIPC) following a cyberattack and subsequent data leak affecting the carrier’s entire 23 million-user base. Reporting indicates the fine was issued after SK Telecom belatedly disclosed a breach of its servers that exposed universal subscriber identity module (USIM) information, and the company moved to challenge the decision just ahead of the deadline to seek revocation.

The PIPC penalty is described as the largest ever issued by the regulator since its establishment, exceeding the combined fines levied against Meta and Google in 2022. In response to the incident and regulatory scrutiny, SK Telecom offered free USIM replacements to users and is expected to argue that its post-incident security spending and reforms, along with the absence of reported direct subscriber financial losses, warrant reconsideration and that the fine is disproportionate compared with prior enforcement actions.