ENKR

KT rogue-femtocell data breach and unauthorised micro-payments

Add to my breach check

Made public · 16,647 people

What leaked4

Replaceable

  • IMSI

Hard to replace

  • Phone IMEI
  • Mobile number
  • Other profile data
  • Other profile dataSMS/ARS messages carrying micropayment authentication codes were intercepted; 368 people had unauthorised payments · PIPC

To-dos

None of the harms this check covers.

What happened next45 events

  1. Undetected 2 events332 days · show events
  2. Response 21 eventsNotice in 6 days · show events
  3. Remedy 6 eventsEnded · show events
  4. Penalty 13 eventsFine ₩54B · show events
  5. Disputes 3 eventsOngoing · Back to latest

Disputes: 3 events

Back to latest
  1. Prosecutors sought 7 years for the femtocell operator (94 victims, about KRW 60 million) and 4 and 6 years for two accomplices
  2. Police: 13 people arrested · 5 detained, 11 sent to prosecutors; femtocell certificate traced to a unit lost in 2020; red notice for the alleged organiser abroad
  3. Court issued arrest warrants for two foreign nationals (device operator and cash-out) on information-network and computer-fraud charges; arrested on 16 September 2025
Company
KT
When it happened
–
Company detected it
Made public
Notice
Leak confirmed
Affected
16,647 people · incl. MVNO, deduplicated; PIPC; 22,227 announced by KT on October 17, 2025; 368 people with unauthorized micropayments · KT

How the facts developed

  1. PIPC decision: 16,647 people; 과징금 539억 7,900만원; criminal complaint (고발) for obstructing the investigation (server log deletion, false submissions)
  2. Second report to PIPC: 20,030 subscribers whose IMSI, IMEI or phone number may have leaked
  3. First report to PIPC: IMSI possibly leaked for 5,561 subscribers

Sources