Who was sanctioned, and for what?

Attackers copied certificates from lost femtocells of KT Corporation into home-made devices, stayed connected to the mobile network undetected for around eleven months, intercepted data on 16,647 subscribers (phone number, IMSI, IMEI) and used intercepted confirmation codes to trigger unauthorised mobile payments of around 240 million KRW affecting 368 people. For inadequate access control – certificates valid for ten years, no IP restriction, no detection of unknown cell IDs – the authority imposed a penalty surcharge of 53,979,000,000 KRW and ordered vulnerability checks and a stronger role for the chief privacy officer.

Authority / court

Personal Information Protection Commission (PIPC, 개인정보보호위원회)

Area of law

Data protection · Data breaches and data security

Legal basis

Personal Information Protection Act (개인정보 보호법) Art. 29, Sanktion nach Art. 64-2(1) Nr. 9; gesonderter Beschluss 제2026-015-094호: Art. 63(1)

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Culpability

negligent

Mitigating circumstances

Reduction of 30% because no benefit was derived and a further 50% for cooperation, remediation, compensation of those affected and protective efforts; increase of 50% because the infringement lasted more than two years.

Liability of senior managers

The company was ordered to define the responsibility and role of its chief privacy officer (CPO) for the whole company clearly and to revise its governance.

Published

30 Jul 2026

Original amount 53,979,000,000 KRW, converted at the ECB reference rate of 29 Jul 2026.

Checked against the official source on 4 Oct 2026 · Direct link

In its own online shop for Galaxy S25 pre-orders, KT Corporation stated that benefits would apply unless the end of the promotion was shown, but then limited them to the first 1,000 orders and unilaterally cancelled 7,127 pre-orders that had come in via a YouTube channel and Genie TV and had already been fully completed. The authority regarded this as false information on key terms and an unjustified refusal to conclude contracts under the Telecommunications Business Act (전기통신사업법), imposed a fine of 640,000,000 KRW and ordered KT to show additional pre-order benefits clearly in future.

Authority / court

Korea Media and Communications Commission (KMCC, 방송미디어통신위원회)

Area of law

Consumer protection and online retail · Misleading advertising and pricing

Legal basis

Telecommunications Business Act (전기통신사업법) Art. 50(1) Nr. 5 und Nr. 5-2

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Published

8 May 2026

Original amount 640,000,000 KRW, converted at the ECB reference rate of 8 May 2026.

Checked against the official source on 4 Oct 2026 · Direct link

Attackers who had planted malware in systems of SK Telecom Co., Ltd. since August 2021 took 9.82 GB of data on around 23 million subscribers from the home subscriber server in April 2025, including USIM authentication keys and IMSI. The authority found a lack of network segregation and access controls, authentication data not securely encrypted, missing security updates, an inadequate set-up of the chief privacy officer function and late notification of those affected. It imposed a penalty surcharge of 134,791,000,000 KRW and an administrative fine of 9,600,000 KRW (134,800,600,000 KRW in total) and issued orders on security, governance and oversight of service providers and sales partners.

Authority / court

Personal Information Protection Commission (PIPC, 개인정보보호위원회)

Area of law

Data protection · Data breaches and data security

Legal basis

Personal Information Protection Act (개인정보 보호법) Art. 29, Art. 31(1) und (3), Art. 34(1); Sanktion nach Art. 64-2(1) Nr. 9

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Repeat case

yes

Mitigating circumstances

Reduction of 30% because no benefit was derived and a further 50% for completed remediation, compensation of those affected and protective efforts; increase of 50% because the infringement lasted more than two years. Cooperation was not taken into account because documents were submitted late.

Liability of senior managers

There was no chief privacy officer (CPO) with overall responsibility; the company was ordered to define the CPO’s responsibility and role clearly and to rebuild its governance.

Published

28 Aug 2025

Original amount 134,800,600,000 KRW, converted at the ECB reference rate of 27 Aug 2025.

Checked against the official source on 4 Oct 2026 · Direct link

According to the KFTC (Korea Fair Trade Commission, Korea's competition authority), the three mobile network operators agreed in November 2015 to balance net gains and losses of new subscribers porting their numbers so that they would not concentrate on one operator, and implemented this until the end of September 2022 by coordinating their sales incentives for dealers with one another; they exchanged the information in a joint market monitoring group with the industry association KAIT. The KFTC issued cease-and-desist orders and provisionally set fines totalling KRW 114,026 million (SK Telecom KRW 42,662 million, KT KRW 33,029 million, LG Uplus KRW 38,334 million).

Authority / court

Korea Fair Trade Commission (KFTC)

Area of law

Competition law · Cartels and collusion

Legal basis

Art. 40 Abs. 1 Nr. 3 MRFTA (Monopoly Regulation and Fair Trade Act)

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Published

12 Mar 2025

Original amount 114,026,000,000 KRW, converted at the ECB reference rate of 12 Mar 2025.

Checked against the official source on 4 Oct 2026 · Direct link

The KFTC (Korea Fair Trade Commission, Korea's competition and consumer authority) found that the games company had changed the probabilities of paid random items (loot boxes) in two of its online games to the players' disadvantage and had failed to disclose this or disclosed it falsely. It treated this as deceiving consumers under the E-Commerce Act and, in addition to a cease-and-desist order, provisionally set fines totalling KRW 11,642 million (KRW 11,593 million for one game, KRW 49 million for the other), according to the KFTC the highest amount under that Act at the time.

Authority / court

Korea Fair Trade Commission (KFTC)

Area of law

Consumer protection and online retail · Misleading advertising and pricing

Legal basis

Art. 21 Abs. 1 Nr. 1 Act on the Consumer Protection in Electronic Commerce (E-Commerce-Gesetz)

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Repeat case

yes

Published

3 Jan 2024

Original amount 11,642,000,000 KRW, converted at the ECB reference rate of 3 Jan 2024.

Checked against the official source on 8 Oct 2026 · Company name anonymised since 3 Jan 2026 · Direct link

The company charged 50% of the fees for the remaining term when an annual plan paid monthly was cancelled after 14 days, and did not refund annual fees paid in advance; the notices about this could only be reached via an information icon during checkout. The authority regarded this as a restriction of the right to cancel and a breach of the duty to explain key contract terms clearly, imposed fines of 876,000,000 KRW and 433,000,000 KRW (1,309,000,000 KRW in total) under the Telecommunications Business Act (전기통신사업법) and ordered the company to display the consequences of cancellation clearly and to improve its penalty and refund rules.

Authority / court

Korea Communications Commission (KCC, 방송통신위원회; seit Oktober 2025 Korea Media and Communications Commission, 방송미디어통신위원회)

Area of law

Consumer protection and online retail · Information duties in online retail

Legal basis

Telecommunications Business Act (전기통신사업법) Art. 50(1) Nr. 5 und Nr. 5-2, Art. 52, Art. 53

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Published

29 Nov 2023

Original amount 1,309,000,000 KRW, converted at the ECB reference rate of 29 Nov 2023.

Checked against the official source on 8 Oct 2026 · Company name anonymised since 29 Nov 2025 · Direct link

Data on 297,117 people – including phone numbers, names, addresses and USIM numbers – from the operator's customer authentication system (CAS) ended up on illegal online marketplaces; the authority found outdated software no longer supported by its vendors, inadequately configured firewalls and intrusion prevention systems and database credentials stored in plain text, and former customers were notified late. It imposed a penalty surcharge of 6,800,452,000 KRW and an administrative fine of 27,000,000 KRW (6,827,452,000 KRW in total) and ordered, among other things, remediation of vulnerabilities across all systems, a reorganised data protection governance and deletion of data no longer needed.

Authority / court

Personal Information Protection Commission (PIPC, 개인정보보호위원회)

Area of law

Data protection · Data breaches and data security

Legal basis

Personal Information Protection Act (개인정보 보호법, Fassung 2020) Art. 29, Art. 21(1), Art. 39-4(1); Sanktion nach Art. 39-15(1) Nr. 5

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Culpability

negligent

Repeat case

yes

Mitigating circumstances

Reduction of 30% for a recognised data protection certification, active cooperation and self-reporting of the incident; at the same time an increase of 50% because the infringement lasted more than two years.

Liability of senior managers

The company was ordered to strengthen the role, standing (including a reporting line directly to top management) and expertise of its chief privacy officer (CPO).

Published

12 Jul 2023

Original amount 6,827,452,000 KRW, converted at the ECB reference rate of 12 Jul 2023.

Checked against the official source on 8 Oct 2026 · Company name anonymised since 12 Jul 2025 · Direct link