Loading story…
SK Telecom filed a lawsuit with the Seoul Administrative Court seeking to revoke a record 135 billion won (US$91 million) penalty imposed by South Korea’s Personal Information Protection Commission (PIPC) following a cyberattack and subsequent data leak affecting the carrier’s entire 23 million-user base. Reporting indicates the fine was issued after SK Telecom belatedly disclosed a breach of its servers that exposed universal subscriber identity module (USIM) information, and the company moved to challenge the decision just ahead of the deadline to seek revocation.
The PIPC penalty is described as the largest ever issued by the regulator since its establishment, exceeding the combined fines levied against Meta and Google in 2022. In response to the incident and regulatory scrutiny, SK Telecom offered free USIM replacements to users and is expected to argue that its post-incident security spending and reforms, along with the absence of reported direct subscriber financial losses, warrant reconsideration and that the fine is disproportionate compared with prior enforcement actions.
See the reporting duties and controls this puts on the clock.
5 events from the most recent confirmed update back to the earliest known activity.
South Korea's Ministry of Science and ICT announced that SK Telecom, KT, and LG Uplus will provide more than seven million subscribers with unmetered 400 Kbps data after monthly allowances are exhausted. The measure was presented as a consumer-protection obligation tied to recent telecom security incidents, including the SK Telecom data leak.
SK Telecom filed suit with the Seoul Administrative Court to revoke the 135 billion-won penalty one day before the filing deadline. The company is expected to argue that it made major security improvements after the incident and that the fine was unfair.
South Korea's Personal Information Protection Commission imposed a record 135 billion-won fine on SK Telecom over the delayed disclosure and data leak. The decision was made in August 2025 and was described as the agency's largest penalty since its establishment.
After the incident was disclosed, SK Telecom offered free USIM replacements to all users. The disclosure was described as delayed, prompting regulatory scrutiny over the company's handling of the breach.
An April cyberattack compromised SK Telecom servers and exposed universal subscriber identity module (USIM) information. The breach reportedly affected the company's entire subscriber base of about 23 million users.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
4 references tracked. Mallory keeps watching after this page renders.
tomshardware.com
Open sourcekoreatimes.co.kr
Open sourcescworld.com
Open sourcedatabreaches.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
South Korea’s Personal Information Protection Commission fined **KT Corporation** KRW 53.979 billion (about **$39 million**) after finding major security failures tied to a long-running compromise of its mobile network. Investigators said attackers used a lost KT femtocell, extracted its valid authentication certificate, and loaded it onto a rogue device to impersonate legitimate network equipment, intercept subscriber traffic, and capture data including phone numbers and authentication codes. The intrusion ran from **October 8, 2024, to September 5, 2025**, exposing the personal information of **16,647 subscribers** and enabling fraudulent mobile micropayments totaling **KRW 240 million** that affected at least **368 customers**. The regulator said KT’s controls were inadequate, citing overly long-lived femtocell certificates and missing IP address restrictions that helped enable the abuse. In a separate finding, the commission said **38 KT IT service network servers** were infected with **`BPFDoor`** malware in March 2024, and alleged that KT failed to report the incident promptly and deleted logs from some compromised systems, obstructing the investigation. Alongside the fine, authorities ordered KT to strengthen femtocell and telecom equipment security, improve privacy governance, expand **ISMS-P** certification coverage across mobile network systems, and are considering legislative changes related to concealment of evidence.
Jul 31, 2026
Comcast moved toward resolving litigation tied to its 2023 **Citrix Bleed**-linked breach, after a federal judge in Pennsylvania granted preliminary approval to a **$117.5M** settlement covering two dozen class actions. The incident was reported as potentially affecting **~30M** current and former customers; proposed relief includes **three years of credit/identity monitoring** plus either reimbursement of documented losses (up to **$10,000**) or a **$50** cash option, while Comcast continues to deny liability despite not opposing preliminary approval. Separately, South Korea’s **SK Telecom** rejected a government-affiliated consumer agency’s proposed compensation framework for a personal data leak, declining a plan that would pay **100,000 won (~$69.40)** per affected petitioner and potentially scale to a much larger total cost; the rejection leaves claimants to pursue individual civil suits. In a different telecom-related development not tied to a breach, the **FCC** opened a dedicated intake channel to collect customer reports as it investigates the **January 14 Verizon outage** that disrupted calling/texting for roughly **10 hours**, including impacts to **911** access; Verizon attributed the disruption to a software issue and offered customer credits.
Jun 29, 2026
South Korea’s Personal Information Protection Commission imposed a record **624.6 billion won** fine on Coupang, plus **248 million won** on subsidiary Coupang Fulfillment Service, after a breach exposed personal data tied to roughly **34 million to 37.55 million people**. Regulators said the incident stemmed from weak security controls, including poor authentication key management and inadequate access restrictions, and that exposed data included names, email addresses, shipping addresses, phone numbers, and order histories. Authorities said the breach began in 2025 and persisted for months before discovery, making it one of the country’s largest retail-sector privacy incidents. The commission also cited Coupang for failures involving data destruction, breach notification, interference with the independence of its data protection officer, and obstruction of the investigation. Investigators identified the main suspect as a former Coupang IT employee, described in one report as a **43-year-old Chinese national**, who allegedly retained sensitive data on multiple hard drives and tried to destroy evidence by discarding a laptop in a river. Coupang said it plans to challenge the penalty, disputed aspects of the exposure, and maintained the stolen data was limited, deleted from recovered devices, and not shared onward.
Jun 29, 2026