Who was sanctioned, and for what?

Attackers copied certificates from lost femtocells of KT Corporation into home-made devices, stayed connected to the mobile network undetected for around eleven months, intercepted data on 16,647 subscribers (phone number, IMSI, IMEI) and used intercepted confirmation codes to trigger unauthorised mobile payments of around 240 million KRW affecting 368 people. For inadequate access control – certificates valid for ten years, no IP restriction, no detection of unknown cell IDs – the authority imposed a penalty surcharge of 53,979,000,000 KRW and ordered vulnerability checks and a stronger role for the chief privacy officer.

Authority / court

Personal Information Protection Commission (PIPC, 개인정보보호위원회)

Area of law

Data protection · Data breaches and data security

Legal basis

Personal Information Protection Act (개인정보 보호법) Art. 29, Sanktion nach Art. 64-2(1) Nr. 9; gesonderter Beschluss 제2026-015-094호: Art. 63(1)

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Culpability

negligent

Mitigating circumstances

Reduction of 30% because no benefit was derived and a further 50% for cooperation, remediation, compensation of those affected and protective efforts; increase of 50% because the infringement lasted more than two years.

Liability of senior managers

The company was ordered to define the responsibility and role of its chief privacy officer (CPO) for the whole company clearly and to revise its governance.

Published

30 Jul 2026

Original amount 53,979,000,000 KRW, converted at the ECB reference rate of 29 Jul 2026.

Checked against the official source on 4 Oct 2026 · Direct link

Attackers who had planted malware in systems of SK Telecom Co., Ltd. since August 2021 took 9.82 GB of data on around 23 million subscribers from the home subscriber server in April 2025, including USIM authentication keys and IMSI. The authority found a lack of network segregation and access controls, authentication data not securely encrypted, missing security updates, an inadequate set-up of the chief privacy officer function and late notification of those affected. It imposed a penalty surcharge of 134,791,000,000 KRW and an administrative fine of 9,600,000 KRW (134,800,600,000 KRW in total) and issued orders on security, governance and oversight of service providers and sales partners.

Authority / court

Personal Information Protection Commission (PIPC, 개인정보보호위원회)

Area of law

Data protection · Data breaches and data security

Legal basis

Personal Information Protection Act (개인정보 보호법) Art. 29, Art. 31(1) und (3), Art. 34(1); Sanktion nach Art. 64-2(1) Nr. 9

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Repeat case

yes

Mitigating circumstances

Reduction of 30% because no benefit was derived and a further 50% for completed remediation, compensation of those affected and protective efforts; increase of 50% because the infringement lasted more than two years. Cooperation was not taken into account because documents were submitted late.

Liability of senior managers

There was no chief privacy officer (CPO) with overall responsibility; the company was ordered to define the CPO’s responsibility and role clearly and to rebuild its governance.

Published

28 Aug 2025

Original amount 134,800,600,000 KRW, converted at the ECB reference rate of 27 Aug 2025.

Checked against the official source on 4 Oct 2026 · Direct link