KT hit with W54b penalty over data breach

The Personal Information Protection Commission said KT’s inadequate regulation of its small-cell base station network allowed hackers using illegally manufactured femtocells to gain unauthorized access to the company’s mobile network.

The breach, which occurred in August last year, exposed the personal information of 16,647 KT subscribers, including consumers of mobile virtual network operators. The leaked information included subscriber identification numbers, device identification numbers and mobile phone numbers.

The incident also resulted in unauthorized mobile payments involving 368 consumers, causing financial losses of about 240 million won, according to the regulator.

The PIPC said the case was particularly serious because the leaked information was later utilized to trigger actual financial harm, rather than remaining a simple exposure of personal data.

The regulator also found that 38 servers connected to KT’s personal information processing systems had been infected with multiple types of malware, including BPFDoor, in March 2025.

“KT was aware of the malware infection on its servers in March last year however failed to report the security breach to the government,” a PIPC official said. “During a full-scale inspection of KT’s servers, we found signs suggesting an organized attempt to conceal the incident, including the deletion of logs from 10 compromised servers.”

The PIPC said it would refer the case to criminal investigation over KT’s failure to report the security incident, deletion of server logs and submission of inaccurate information.

The penalty is significantly reduce than the maximum amount KT could have faced under Korea’s Personal Information Protection Act, which allows fines of up to 3 percent of a company’s relevant annual revenue. Earlier estimates had suggested the penalty could reach as high as 190 billion won.

In determining the final amount, the commission considered factors including the scale of the breach compared with recent cases involving SK Telecom and Coupang, the duration of the violations, corrective measures taken by KT and the company’s efforts to compensate affected customers, including waiving cancellation fees.

KT said it accepted the regulator’s decision and apologized again to causing attention among customers and the general.

“We are rebuilding our personal information protection system from the ground up and expanding security investment to prevent similar incidents and restore customer trust,” a KT official said.

KT added that it would review the regulator’s written decision before deciding whether to pursue legal action.

Separately, the PIPC said it plans to request an investigation into LG Uplus over allegations that the company disposed of servers before the regulator launched a probe into a suspected data breach, possibly destroying evidence.