South Korea Fines KT $39 Million Over Femtocell Breach and BPFDoor Cover-Up

South Korea’s Personal Information Protection Commission fined KT Corporation KRW 53.979 billion (about $39 million) after finding major security failures tied to a long-running compromise of its mobile network. Investigators said attackers used a lost KT femtocell, extracted its valid authentication certificate, and loaded it onto a rogue device to impersonate legitimate network equipment, intercept subscriber traffic, and capture data including phone numbers and authentication codes. The intrusion ran from October 8, 2024, to September 5, 2025, exposing the personal information of 16,647 subscribers and enabling fraudulent mobile micropayments totaling KRW 240 million that affected at least 368 customers.

The regulator said KT’s controls were inadequate, citing overly long-lived femtocell certificates and missing IP address restrictions that helped enable the abuse. In a separate finding, the commission said 38 KT IT service network servers were infected with BPFDoor malware in March 2024, and alleged that KT failed to report the incident promptly and deleted logs from some compromised systems, obstructing the investigation. Alongside the fine, authorities ordered KT to strengthen femtocell and telecom equipment security, improve privacy governance, expand ISMS-P certification coverage across mobile network systems, and are considering legislative changes related to concealment of evidence.