ENKR

KT rogue-femtocell data breach and unauthorised micro-payments

Add to my breach check

Made public · 16,647 people

What leaked4

Replaceable

  • IMSI

Hard to replace

  • Phone IMEI
  • Mobile number
  • Other profile data
  • Other profile dataSMS/ARS messages carrying micropayment authentication codes were intercepted; 368 people had unauthorised payments · PIPC

To-dos

None of the harms this check covers.

What happened next45 events

  1. Undetected 2 events332 days · show events
  2. Response 21 eventsNotice in 6 days · show events
  3. Remedy 6 eventsEnded · show events
  4. Penalty 13 eventsFine ₩54B · show events
  5. Disputes 3 eventsOngoing · show events
  1. Statement apologising after the PIPC decision; position on an appeal to follow after receiving the written decision
  2. PIPC decided to file a criminal complaint against KT for obstructing its investigation · unreported 2024 malware infection, log deletion, false submissions
  3. Corrective order · femtocell and network vulnerability checks, CPO role; plan within 3 months, ISMS-P recommendation, publication order
  4. PIPC penalty surcharge of KRW 53.979 billion
  5. PIPC found 16,647 people's phone number, IMSI and IMEI leaked through rogue femtocells over about 11 months, with SMS/ARS interception
40 more
  1. Prosecutors sought 7 years for the femtocell operator (94 victims, about KRW 60 million) and 4 and 6 years for two accomplices
  2. New CEO took office, replacing the CEO in office during the breach
  3. MSIT administrative fine of KRW 26.25 million for late intrusion reporting · KRW 21 million paid
  4. Customer package extended to everyone on KT mobile at the end of January 2026: from February, 100 GB data a month for six months (to July 2026) and a six-month TVING or Disney+ pass; two years of free fraud insurance
  5. Termination fees waived for all subscribers for two weeks, until 13 January 2026Ended January 13, 2026
  6. Refunds of waived termination fees claimable 14 to 31 January 2026, including cancellations since 1 September 2025; excluded: new, device-change or renewed contracts since 1 September, MVNO, IoT and cancellations made by KTClosed January 31, 2026
  7. KRW 1 trillion information-security investment over 5 years, CISO-led accountability
  8. Offered a customer package of about KRW 450 billion: 100 GB data a month for 6 months, 50% extra roaming data, 6-month OTT pass, membership discounts, 2-year fraud insurance
  9. CEO apologised at a briefing on the breach and a security overhaul
  10. Police: 13 people arrested · 5 detained, 11 sent to prosecutors; femtocell certificate traced to a unit lost in 2020; red notice for the alleged organiser abroad
  11. MSIT found KT at fault and said termination fees should be waived for all subscribers
  12. MSIT confirmed that 368 people were hit by unauthorised carrier-billing payments made through the rogue femtocells · 777 payments, about KRW 243 million
  13. MSIT final result: 22,227 people's IMSI/IMEI/numbers leaked; 94 servers infected with 103 malware types; KT to submit a plan by January 2026 to prevent a repeat
  14. PIPC widened its investigation to the March 2024 malware infection of 38 KT servers
  15. MSIT interim result: weak femtocell authentication; 43 malware-infected servers (BPFDoor, web shells) found in 2024 and not reported
  16. Free USIM replacement for all customers began, rolled out by region · nationwide from 3 December 2025
  17. CEO told the board he would not seek another term, serving until March 2026
  18. Offered confirmed micro-payment and data-leak victims 100 GB data a month for 5 months and a KRW 150,000 bill or handset discount, plus fraud-loss insurance for 3 years
  19. Full-survey results: 20 rogue femtocell IDs, 22,227 people with possible IMSI/IMEI/number exposure, 368 micro-payment victims; leak start revised to October 2024
  20. Third breach report to PIPC after further leaks were found
20 more
  1. MSIT asked police to investigate KT for obstructing official duties · false server-disposal dates, unreported backup logs
  2. Second breach report to PIPC after further leaks were found
  3. Server-intrusion report to KISA at 23:57, three days after KT recorded becoming aware of it · 15 September 2025, 14:00
  4. Court issued arrest warrants for two foreign nationals (device operator and cash-out) on information-network and computer-fraud charges; arrested on 16 September 2025
  5. PASS biometric authentication made mandatory for gift-card micro-payments
  6. Free USIM replacement and USIM protection service for about 19,000 customers who received the rogue base station signal · MVNO included
  7. Charges for unauthorised micro-payments waived for confirmed victims
  8. Lookup for whether one was affected, linked in the notice texts
  9. Text messages to the 5,561 customers whose IMSI may have leaked
  10. CEO and executives apologised at a press conference
  11. First breach report to PIPC: 5,561 people
  12. PIPC opened an investigation on its own initiative after damage reports and press coverage
  13. MSIT formed a public-private joint investigation team
  14. Intrusion report to KISA
  15. KT confirmed that an unregistered rogue femtocell had connected to its internal network
  16. KT blocked abnormal micro-payment attempts
  17. KT acted on the abnormal traffic pattern behind the unauthorised micro-payments; MSIT counted its intrusion report on 8 September as late
  18. 24-hour dedicated customer centre for misuse reports and micro-payment questions
  19. Police asked KT to analyse the damage from unauthorised micro-payments
  20. Intrusion began
Company
KT
When it happened
–
Company detected it
Made public
Notice
Leak confirmed
Affected
16,647 people · incl. MVNO, deduplicated; PIPC; 22,227 announced by KT on October 17, 2025; 368 people with unauthorized micropayments · KT

How the facts developed

  1. PIPC decision: 16,647 people; 과징금 539억 7,900만원; criminal complaint (고발) for obstructing the investigation (server log deletion, false submissions)
  2. Second report to PIPC: 20,030 subscribers whose IMSI, IMEI or phone number may have leaked
  3. First report to PIPC: IMSI possibly leaked for 5,561 subscribers

Sources