Historical data breach fines: What distinguished Coupang, SKT, and KT?

A fine of 54 billion won has been imposed following the 'KT fake base station' incident, in which small base stations installed by telecom operators inside homes with poor signal coverage became hacking conduits, enabling unauthorized micro-payments via other people's mobile phones. The act of concealing the incident and obstructing the investigation will be transferred to criminal proceedings separately from the fine.

The Personal Information Protection Commission announced on the 30th that it held its 15th plenary meeting on the 29th, imposing a fine of 53.979 billion won on KT for violating safety measure obligations under the Personal Information Protection Act and decided to issue orders for corrective measures, improvement recommendations, and public disclosure. This is the third-largest fine imposed by the commission, following Coupang (62.46 billion won) and SK Telecom (134.791 billion won). The commission plans to file a criminal complaint against KT for submitting false data and deleting logs during the investigation, and will request an investigation into LG Uplus on charges of obstructing official duties for discarding servers before the investigation began.

According to the Personal Information Protection Commission, this penalty is a sanction against the hacking of "fake base stations" that shook the telecommunications industry last year. Using illegal equipment created by duplicating certificates from lost KT femtocells (small base stations), hackers accessed KT's internal network for approximately 11 months from October 2024 to September 2025, intercepting the mobile numbers and subscriber and device identification numbers of 16,647 users, including those on MVNOs. They also stole payment authentication texts and calls, causing unauthorized micro-payment damages totaling about 240 million won to 368 individuals. The Personal Information Protection Commission stated, "This case is extremely serious as it did not merely result in data leakage but led to actual financial losses."

According to the investigation by the Personal Information Protection Commission, KT set the validity period of femtocell certificates at 10 years and did not restrict access IP addresses, among other issues, resulting in overall inadequate internal network access controls. Consequently, KT failed to detect any abnormal access for 11 months. While KT argued that it was an unpredictable new type of attack, the Commission rejected this claim. The administrative fine was calculated based on the 5G and LTE sales revenue from the mobile communication service where the incident occurred.

The reason for the whistleblower complaint is concealment. Despite indications that 38 KT servers were infected with malware in March 2024, leading to the leakage of information belonging to employees and staff of partner companies, KT failed to report this to the government and instead covered it up through internal measures. During a comprehensive inspection in April 2025, logs from 10 infected servers were deleted. When questioned by the Personal Information Protection Commission, they testified that "no preserved data exists," but after being exposed during a digital forensic investigation, they late submitted the logs they had been keeping.

LG Uplus reinstalled the operating systems of related servers, including its All-in-One Password Management System (APPM), and scrapped the servers after a breach was identified following an August 2025 announcement by Phrack, a U.S.-based hacking magazine, thereby obstructing any investigation into how the data was leaked, even before the Personal Information Protection Commission launched its inquiry.

The divergence in penalties imposed on the two companies—ranging from criminal reporting to referral for investigation—stems from a legal loophole. Under the current Personal Information Protection Act, only acts that obstruct an ongoing investigation are punishable. Consequently, LG Uplus, which destroyed evidence before the investigation commenced, could only be referred to law enforcement authorities under the Criminal Act for obstruction of official duties. This creates a paradoxical blind spot where parties who destroy evidence in advance may actually gain an advantage when incidents occur. The Personal Information Protection Commission plans to push for legislative amendments this year, including the introduction of criminal penalties for concealing or destroying evidence prior to the start of an investigation, administrative fines of up to 3% of total sales revenue for such concealment or destruction, and daily coercive fines of 0.3% of daily sales revenue for non-cooperation with investigations, alongside the adoption of orders for preservation of evidence.

KT must submit a report on measures to prevent recurrence, including inspections of communication facility vulnerabilities and the substantive performance of duties by the Chief Privacy Officer (CPO), within three months, and publicly disclose the disciplinary action on its official website.

Song Kyung-hee, Chairperson of the Personal Information Protection Commission, stated, "This penalty should serve as an opportunity to further strengthen security capabilities across the entire telecommunications industry," and added, "We will improve the system so that acts of concealing or downplaying data result in significant disadvantages for companies, thereby instilling in the industry a recognition that transparent disclosure is the most rational choice."

The KT personal information breach differs from previous hacking incidents in that hackers replicated a telecom company's small base station to infiltrate the core communication network. Rather than attacking servers storing personal data, they inserted themselves between users' smartphones and the communication network, intercepting both voice calls and text message authentication codes.

According to survey results released by the Personal Information Protection Commission on the 30th, the starting point of the KT attack was "femtocells." Femtocells are small base stations installed in areas with weak mobile communication signals, such as homes, offices, and underground spaces. Owned by KT, these devices are directly installed by technicians, while KT manages all aspects including network access approval, certificate issuance, and internal network access rights.

The hacker copied the certificate stored in the lost KT femtocell and inserted it into self-made equipment, effectively stealing the identity card of legitimate equipment and attaching it to a fake base station. Subsequently, the device induced nearby users' smartphones to recognize the illegal equipment as a normal base station and connect to it.

When the Daejeon phone number was illegally connected to a femtocell, hackers intercepted the Daejeon phone numbers and subscriber identity module (IMSI) and device identification numbers (IMEI) traveling between the terminal and KT's internal network. They then combined this with separately obtained names, genders, and birth dates to apply for small-amount payments using the Daejeon phone number.

Authentication required for payment approval was also breached at the same point. Text messages (SMS) containing authentication codes and automated response calls (ARS) were routed through illegal femtocells, which hackers intercepted to finalize payment approval. 368 people suffered losses totaling approximately 240 million won. The issue did not end with personal information leaking externally; the very process of identity verification via mobile networks was rendered ineffective.

The security loopholes in KT confirmed by the Personal Information Protection Commission were not just one or two. The validity period of femtocell certificates extended up to 10 years, meaning that even if equipment was lost or certificates were duplicated, they could be exploited for a long period; however, controls to revoke or renew them did not function properly.

The internal network access IP was not restricted either. Access was possible not only through the dedicated lines managed by KT but also from other carriers or overseas IPs, provided the stolen certificates were available. There was also a bypass route that connected directly to the core communication network without passing through the femtocell management server. The cell ID (Cell ID), which is the identifier assigned when equipment connects to the communication network, was not managed at all; as a result, unregistered devices could attach to the network without being detected or blocked.

These vulnerabilities overlapped, allowing hackers to remain inside KT's internal network for approximately 11 months from October 2024 to September 2025 without undergoing any additional authentication procedures. KT failed to detect any abnormal signs during this period and only identified the unauthorized access after negative payment incidents and user complaints had accumulated.

KT argued that the attack was of an unprecedented nature, as a hacker had directly manufactured femtocells, making it difficult to predict. The Personal Information Protection Commission reached a different conclusion. Femtocells are essential equipment that communications from users in shadowed areas must necessarily pass through, and hacking via femtocells is an issue for which security vulnerabilities have been pointed out in overseas cases and by the academic community. This means the core issue is not the novelty of the method, but whether the telecommunications network operator fulfilled its fundamental obligation to implement access control.

The Personal Information Protection Commission ordered KT to inspect vulnerabilities across all wireless communication network equipment, including femtocells, and to strengthen access controls over personal information within the communication network. The commission also recommended expanding the Personal Information Protection Management System (ISMS-P) certification, which was previously held only for certain IT services, to cover the mobile communication networks and systems where the breach occurred. This ruling confirms that the defense line protecting personal information lies not in servers but in the communication network itself.

The Personal Information Protection Commission announced on the 30th that it imposed a fine of 53.979 billion won on KT for the data breach incident.

According to the Personal Information Protection Commission, hackers extracted certificates from a lost KT femtocell and installed them in a self-made femtocell to access the KT mobile network. They then lured user devices to route through the hacker's femtocell, intercepting transmission and reception information between the devices and the internal network. By combining this newly acquired data with additional personal information, they requested small-amount mobile payments and successfully completed unauthorized transactions by stealing ARS and SMS messages containing payment authentication codes.

Investigation results revealed that personal information of 16,647 KT users was leaked, and unauthorized small-amount payment damages totaling approximately 240 million won were confirmed to have occurred against a total of 368 individuals. The Personal Information Protection Commission explained that the severity is high because the leaked personal information led to actual financial losses.

The incident was revealed to have occurred because KT, while managing and operating femtocells, neglected basic access control management of its internal network. Access IP restrictions were not implemented for femtocells connecting to the internal network, allowing connections from third-party or overseas IPs. Furthermore, it was found that there was no detection and response system in place for unauthorized cell ID connection anomalies, and access control management for KT's internal network personal information processing systems via femtocells was also neglected.

The Personal Information Protection Commission stated that the administrative fine was calculated based on relevant sales revenue, not exceeding 3 percent of total sales revenue. The fine for KT's mobile communication services where unauthorized small-payment incidents occurred was calculated based on its 5G and LTE communication sales revenue, excluding independent sales revenues such as those from IPTV and internet communications.

The reason for the difference in the administrative penalty (134.791 billion won) imposed last year for the SK Telecom data breach compared to the amount is that the type of information leaked and the scale of damage differ. In the SKT incident, subscriber identification numbers, which are critical information, were leaked, and the scale of damage exceeded 20 million people, leading to a judgment that it was more serious than the KT incident. The Personal Information Protection Commission classified the SKT incident as a very serious violation, while the KT incident was classified as a serious violation. The fact that victim compensation and corrective measures were implemented quickly served as mitigating factors.

KT was found to have first become aware of a malicious code infection on its own servers in March 2024 but failed to report the security breach and proceeded with self-directed measures without conducting a detailed analysis of whether personal data had been compromised. KT also systematically concealed the incident, including by deleting logs from some of the affected servers. During the investigation, KT falsely stated that no preservation materials existed for the infected servers and later submitted logs belatedly, substantially obstructing the accident investigation. The Personal Information Protection Commission has decided to file criminal charges against KT on these grounds.

Meanwhile, the Personal Information Protection Commission decided to request an investigation into LG Uplus on this day. This is because LG Uplus reinstalled or discarded the operating systems of relevant servers, including the APPM server, before the Commission began its investigation, making it difficult to verify the exact circumstances of the data breach and whether there was any additional leakage.

KT was fined an amount exceeding 50 billion won for violating mandatory safety measures related to a hacking incident. Some interpretations suggest the penalty is excessive compared to previous cases, given that the number of victims fell short of 20,000.

The Personal Information Protection Commission announced on the 30th that it held its 15th plenary meeting on the 29th, deciding to impose a fine of 53.979 billion won on KT and issue orders for corrective measures, improvement recommendations, and public disclosure. The fine ratio stands at approximately 0.8% of the 2022–2024 5G and LTE business sales, which serve as the basis for the penalty, totaling 6.5 trillion won.

This is similar to the rate for SK Telecom (1%) but lower than that of Coupang (1.8%). The Personal Information Protection Commission announced that a total of 16,647 mobile phone numbers, subscriber identity module identifiers (IMSI), and terminal identification numbers (IMEI) were among the personal information leaked. KT reported 22,227 cases, but the number of affected individuals decreased after removing duplicates such as corporate accounts and multiple lines. Compared to SKT and Coupang, which had 23 million and 37 million personal information records leaked respectively, the scale of this leak is on the order of one-thousandth.

The reason the fine ratio is large compared to the scale of the leak is that actual financial damage occurred. Hackers stole ARS and SMS containing payment authentication codes, causing unauthorized small-amount payment damages totaling 243 million won (777 cases) for a total of 368 people. Professor Choi Kyung-jin of Gachon University's Department of Law (Korean Artificial Intelligence Association) stated, "The fine amount is large compared to the scale of damage," and interpreted that the Personal Information Protection Commission issued a warning against cases where simple leaks led to actual harm.

The industry was shocked that despite KT completing follow-up measures, including a full replacement of the 'femtocell' that served as a hacking channel, it was still hit with administrative fines amounting to hundreds of billions of won. The fact that USIM authentication keys were not leaked, minimizing the risk of secondary damage, and that sensitive information such as purchase details, addresses, and door passwords were not leaked, as in the case of Coupang, did not significantly mitigate the penalties. Professor Choi stated, "There may have been a factor of concealing the fact of malware infection discovered during the investigation, which was deemed an aggravating circumstance, contributing to the increased fines."

However, skepticism has also been raised regarding punitive fines. Lee Seong-yeop of Korea University's Technology Management Program stated, "There is a theoretical problem with imposing monetary penalties in the form of fines even when there are no unjust gains," and added, "While this applies to SKT and Coupang as well, whether the fines were appropriately calculated will be verified in future lawsuits." He further expressed regret that "the process for calculating fines, including how aggravating and mitigating ratios are applied, is not transparently disclosed," making it difficult for experts to reach a consensus.

Park Chun-sik, former professor of cybersecurity at Ajou University, also stated, "Since regulation alone is not a panacea, government authorities should also take care of preventive measures in advance, such as using part of the fines to strengthen security budgets for small and mid-sized companies."

KT has stated that it is taking all necessary measures to prevent a recurrence. A KT official said, "We take the disciplinary action seriously. We sincerely apologize for causing you worry and anxiety." The official added, "We are re-evaluating our personal information protection system from scratch and will make every effort to prevent a recurrence and restore trust by expanding security investments and strengthening company-wide personal information protection capabilities."