ENKR

KT rogue-femtocell data breach and unauthorised micro-payments

Add to my breach check

Made public · 16,647 people

What leaked4

Replaceable

  • IMSI

Hard to replace

  • Phone IMEI
  • Mobile number
  • Other profile data
  • Other profile dataSMS/ARS messages carrying micropayment authentication codes were intercepted; 368 people had unauthorised payments · PIPC

To-dos

None of the harms this check covers.

What happened next45 events

  1. Undetected 2 events332 days · show events
  2. Response 21 eventsNotice in 6 days · show events
  3. Remedy 6 eventsEnded · show events
  4. Penalty 13 eventsFine ₩54B · Back to latest
  5. Disputes 3 eventsOngoing · show events

Penalty: 13 events

Back to latest
  1. PIPC decided to file a criminal complaint against KT for obstructing its investigation · unreported 2024 malware infection, log deletion, false submissions
  2. Corrective order · femtocell and network vulnerability checks, CPO role; plan within 3 months, ISMS-P recommendation, publication order
  3. PIPC penalty surcharge of KRW 53.979 billion
  4. PIPC found 16,647 people's phone number, IMSI and IMEI leaked through rogue femtocells over about 11 months, with SMS/ARS interception
  5. MSIT administrative fine of KRW 26.25 million for late intrusion reporting · KRW 21 million paid
8 more
  1. MSIT found KT at fault and said termination fees should be waived for all subscribers
  2. MSIT final result: 22,227 people's IMSI/IMEI/numbers leaked; 94 servers infected with 103 malware types; KT to submit a plan by January 2026 to prevent a repeat
  3. PIPC widened its investigation to the March 2024 malware infection of 38 KT servers
  4. MSIT interim result: weak femtocell authentication; 43 malware-infected servers (BPFDoor, web shells) found in 2024 and not reported
  5. MSIT asked police to investigate KT for obstructing official duties · false server-disposal dates, unreported backup logs
  6. PIPC opened an investigation on its own initiative after damage reports and press coverage
  7. MSIT formed a public-private joint investigation team
  8. Police asked KT to analyse the damage from unauthorised micro-payments
Company
KT
When it happened
–
Company detected it
Made public
Notice
Leak confirmed
Affected
16,647 people · incl. MVNO, deduplicated; PIPC; 22,227 announced by KT on October 17, 2025; 368 people with unauthorized micropayments · KT

How the facts developed

  1. PIPC decision: 16,647 people; 과징금 539억 7,900만원; criminal complaint (고발) for obstructing the investigation (server log deletion, false submissions)
  2. Second report to PIPC: 20,030 subscribers whose IMSI, IMEI or phone number may have leaked
  3. First report to PIPC: IMSI possibly leaked for 5,561 subscribers

Sources