ENKR

KT rogue-femtocell data breach and unauthorised micro-payments

Add to my breach check

Made public · 16,647 people

What leaked4

Replaceable

  • IMSI

Hard to replace

  • Phone IMEI
  • Mobile number
  • Other profile data
  • Other profile dataSMS/ARS messages carrying micropayment authentication codes were intercepted; 368 people had unauthorised payments · PIPC

To-dos

None of the harms this check covers.

What happened next45 events

  1. Undetected 2 events332 days · show events
  2. Response 21 eventsNotice in 6 days · show events
  3. Remedy 6 eventsEnded · Back to latest
  4. Penalty 13 eventsFine ₩54B · show events
  5. Disputes 3 eventsOngoing · show events

Remedy: 6 events

Back to latest
  1. Customer package extended to everyone on KT mobile at the end of January 2026: from February, 100 GB data a month for six months (to July 2026) and a six-month TVING or Disney+ pass; two years of free fraud insurance
  2. Termination fees waived for all subscribers for two weeks, until 13 January 2026Ended January 13, 2026
  3. Refunds of waived termination fees claimable 14 to 31 January 2026, including cancellations since 1 September 2025; excluded: new, device-change or renewed contracts since 1 September, MVNO, IoT and cancellations made by KTClosed January 31, 2026
  4. Offered a customer package of about KRW 450 billion: 100 GB data a month for 6 months, 50% extra roaming data, 6-month OTT pass, membership discounts, 2-year fraud insurance
  5. Offered confirmed micro-payment and data-leak victims 100 GB data a month for 5 months and a KRW 150,000 bill or handset discount, plus fraud-loss insurance for 3 years
  6. Charges for unauthorised micro-payments waived for confirmed victims
Company
KT
When it happened
–
Company detected it
Made public
Notice
Leak confirmed
Affected
16,647 people · incl. MVNO, deduplicated; PIPC; 22,227 announced by KT on October 17, 2025; 368 people with unauthorized micropayments · KT

How the facts developed

  1. PIPC decision: 16,647 people; 과징금 539억 7,900만원; criminal complaint (고발) for obstructing the investigation (server log deletion, false submissions)
  2. Second report to PIPC: 20,030 subscribers whose IMSI, IMEI or phone number may have leaked
  3. First report to PIPC: IMSI possibly leaked for 5,561 subscribers

Sources