Loading story…
South Korea’s Personal Information Protection Commission fined KT Corporation KRW 53.979 billion (about $39 million) after finding major security failures tied to a long-running compromise of its mobile network. Investigators said attackers used a lost KT femtocell, extracted its valid authentication certificate, and loaded it onto a rogue device to impersonate legitimate network equipment, intercept subscriber traffic, and capture data including phone numbers and authentication codes. The intrusion ran from October 8, 2024, to September 5, 2025, exposing the personal information of 16,647 subscribers and enabling fraudulent mobile micropayments totaling KRW 240 million that affected at least 368 customers.
The regulator said KT’s controls were inadequate, citing overly long-lived femtocell certificates and missing IP address restrictions that helped enable the abuse. In a separate finding, the commission said 38 KT IT service network servers were infected with BPFDoor malware in March 2024, and alleged that KT failed to report the incident promptly and deleted logs from some compromised systems, obstructing the investigation. Alongside the fine, authorities ordered KT to strengthen femtocell and telecom equipment security, improve privacy governance, expand ISMS-P certification coverage across mobile network systems, and are considering legislative changes related to concealment of evidence.
See the reporting duties and controls this puts on the clock.
6 events from the most recent confirmed update back to the earliest known activity.
KT submitted its initial data breach notification on September 11, 2025. The company initially reported that data belonging to about 5,500 customers had been exposed.
PIPC opened an investigation on September 10, 2025, after users reported fraudulent micropayments. The probe later examined both the subscriber-data breach and KT's handling of earlier malware infections.
The internal KT network compromise lasted until September 5, 2025. PIPC later said the incident exposed 16,647 subscribers' personal information and enabled KRW 240 million in fraudulent mobile payments affecting at least 368 people.
On October 8, 2024, attackers began abusing a lost KT femtocell's valid authentication certificate on a rogue device to impersonate legitimate network equipment and intercept subscriber traffic. The compromise ultimately enabled theft of telecom identifiers and authentication data used in fraudulent mobile micropayments.
Investigators later found that 38 KT IT service network servers had been compromised by malware, including BPFDoor, in March 2024. PIPC alleged KT knew of the infection, did not promptly report it, and deleted logs from some compromised systems, hindering the investigation.
South Korea's Personal Information Protection Commission fined KT Corporation KRW 53.979 billion over data protection violations tied to the breach and ordered the company to strengthen femtocell and telecom equipment security, reinforce privacy governance, and expand ISMS-P certification coverage. PIPC also said it would pursue legislative changes to impose stronger penalties for concealing or destroying evidence during investigations.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**SK Telecom** filed a lawsuit with the **Seoul Administrative Court** seeking to revoke a record **135 billion won (US$91 million)** penalty imposed by South Korea’s **Personal Information Protection Commission (PIPC)** following a cyberattack and subsequent data leak affecting the carrier’s entire **23 million-user** base. Reporting indicates the fine was issued after SK Telecom **belatedly disclosed** a breach of its servers that exposed **universal subscriber identity module (USIM)** information, and the company moved to challenge the decision just ahead of the deadline to seek revocation. The PIPC penalty is described as the **largest ever** issued by the regulator since its establishment, exceeding the combined fines levied against **Meta** and **Google** in 2022. In response to the incident and regulatory scrutiny, SK Telecom offered **free USIM replacements** to users and is expected to argue that its post-incident security spending and reforms, along with the absence of reported direct subscriber financial losses, warrant reconsideration and that the fine is disproportionate compared with prior enforcement actions.
Jun 29, 2026
South Korea’s Personal Information Protection Commission imposed a record **624.6 billion won** fine on Coupang, plus **248 million won** on subsidiary Coupang Fulfillment Service, after a breach exposed personal data tied to roughly **34 million to 37.55 million people**. Regulators said the incident stemmed from weak security controls, including poor authentication key management and inadequate access restrictions, and that exposed data included names, email addresses, shipping addresses, phone numbers, and order histories. Authorities said the breach began in 2025 and persisted for months before discovery, making it one of the country’s largest retail-sector privacy incidents. The commission also cited Coupang for failures involving data destruction, breach notification, interference with the independence of its data protection officer, and obstruction of the investigation. Investigators identified the main suspect as a former Coupang IT employee, described in one report as a **43-year-old Chinese national**, who allegedly retained sensitive data on multiple hard drives and tried to destroy evidence by discarding a laptop in a river. Coupang said it plans to challenge the penalty, disputed aspects of the exposure, and maintained the stolen data was limited, deleted from recovered devices, and not shared onward.
Jun 29, 2026
South Korean regulators have notified **Lotte Card** that it faces about **5 billion won** in financial penalties and a **business suspension of more than four months** after hackers breached the company’s online payment system and exposed personal information belonging to about **2.97 million customers**. The notice was issued by the **Financial Supervisory Service**, with the **Financial Services Commission** expected to finalize the sanctions. Investigators found that Lotte Card had also failed to apply sufficient encryption to log files, adding to the severity of the case. The action represents a second major penalty tied to the same incident after the country’s data protection watchdog previously imposed an additional **9.62 billion won** fine, underscoring South Korea’s tougher enforcement posture, which can include suspending new customer sign-ups and penalizing executives after major breaches.
Jun 29, 2026