ENKR

KT rogue-femtocell data breach and unauthorised micro-payments

Add to my breach check

Made public · 16,647 people

What leaked4

Replaceable

  • IMSI

Hard to replace

  • Phone IMEI
  • Mobile number
  • Other profile data
  • Other profile dataSMS/ARS messages carrying micropayment authentication codes were intercepted; 368 people had unauthorised payments · PIPC

To-dos

None of the harms this check covers.

What happened next45 events

  1. Undetected 2 events332 days · Back to latest
  2. Response 21 eventsNotice in 6 days · show events
  3. Remedy 6 eventsEnded · show events
  4. Penalty 13 eventsFine ₩54B · show events
  5. Disputes 3 eventsOngoing · show events

Undetected: 2 events

Back to latest
  1. KT acted on the abnormal traffic pattern behind the unauthorised micro-payments; MSIT counted its intrusion report on 8 September as late
  2. Intrusion began
Company
KT
When it happened
–
Company detected it
Made public
Notice
Leak confirmed
Affected
16,647 people · incl. MVNO, deduplicated; PIPC; 22,227 announced by KT on October 17, 2025; 368 people with unauthorized micropayments · KT

How the facts developed

  1. PIPC decision: 16,647 people; 과징금 539억 7,900만원; criminal complaint (고발) for obstructing the investigation (server log deletion, false submissions)
  2. Second report to PIPC: 20,030 subscribers whose IMSI, IMEI or phone number may have leaked
  3. First report to PIPC: IMSI possibly leaked for 5,561 subscribers

Sources