South Korea’s largest telco has been handed a multimillion-dollar fine by the country’s data protection regulator after serious security failings enabled hackers to defraud its customers.
KT, formerly Korea Telecom, serves over 13 million mobile subscribers, the majority of the domestic market, and nearly half of the country’s high-speed internet users.
However, Seoul’s Personal Information Protection Commission (PIPC) opened an investigation into the company in September 2025 after reports that customers were impacted by fraudulent micropayments.
The firm subsequently notified the PIPC about a breach of personally identifiable information (PII).
Read more on South Korean breaches: South Korean Police Raid Coupang Over Data Breach as CEO Resigns
The PIPC traced the fraud back to theft of a femtocell: a small, low-powered cellular base station usually designed for home or small business use.
“The hacker extracted a certificate from a lost KT femtocell, embedded it into a self-made femtocell, and then accessed the KT mobile network. Subsequently, the hacker induced user terminals to pass through the hacker’s femtocell to intercept transmission and reception information between the terminals and the internal network,” the PIPC explained.
“By combining this information with additionally obtained personal information (name, gender, date of birth), the hacker requested a mobile phone micropayment and then stole ARS and SMS messages containing payment authentication codes, successfully making unauthorized micropayments.”
In total, mobile phone number, subscriber identification number (IMSI), and device identification number (IMEI) details on 16,647 users were compromised in this way. Some 368 customers were defrauded to the tune of 240 million won ($175,000) via unauthorized micropayments.
A Mandate to Improve Security Posture
The regulator ruled that the incident stemmed from a lack of “basic access control management” for KT’s internal network, which allowed the threat actors to connect their rogue femtocell.
“KT’s femtocell management system was generally inadequate, allowing unauthorized femtocells to easily access KT’s internal network,” the PIPC said.
“KT had set the validity period of femtocell certificates issued for internal network access to a long period of 10 years and did not restrict the IP addresses of femtocells accessing the internal network, allowing access from other companies or overseas IP addresses.”
The regulator also noted that individuals were able to bypass the femtocell management server, and that insufficient detection and response capabilities meant the breach went unnoticed for 11 months.
The PIPC mandated the strengthening of security posture through vulnerability checks for wireless communication equipment, and improved governance.
PIPC Uncovers Backdoor Malware
There was more bad news for KT after investigators found evidence that 38 internal servers had been infected with various strains of malware including the BPFDoor backdoor.
“Upon investigation, it was confirmed that in March 2024, a hacker infiltrated the network by exploiting a vulnerability on the KT Roaming Rental Service website and infected multiple servers by uploading a malicious code file,” the PIPC said.
“There were indications that the hacker viewed and leaked the personal information (name, phone number, account) of KT employees and some employees of partner companies through an SQL injection attack* on the Roaming Rental Service administrator page.”
The regulator was unable to determine if the breach scope extended further due to the absence of network logs.
KT didn’t report the breach to the government at the time, instead choosing to deal with it internally without conducting a detailed analysis into whether PII had been leaked.
The PIPC has subsequently filed a complaint over this, as well as the deletion of server logs, submission of false data, retraction of statements by KT during its investigation.
