ENKR

KT rogue-femtocell data breach and unauthorised micro-payments

Add to my breach check

Made public · 16,647 people

What leaked4

Replaceable

  • IMSI

Hard to replace

  • Phone IMEI
  • Mobile number
  • Other profile data
  • Other profile dataSMS/ARS messages carrying micropayment authentication codes were intercepted; 368 people had unauthorised payments · PIPC

To-dos

None of the harms this check covers.

What happened next45 events

  1. Undetected 2 events332 days · show events
  2. Response 21 eventsNotice in 6 days · Back to latest
  3. Remedy 6 eventsEnded · show events
  4. Penalty 13 eventsFine ₩54B · show events
  5. Disputes 3 eventsOngoing · show events

Response: 21 events

Back to latest
  1. Statement apologising after the PIPC decision; position on an appeal to follow after receiving the written decision
  2. New CEO took office, replacing the CEO in office during the breach
  3. KRW 1 trillion information-security investment over 5 years, CISO-led accountability
  4. CEO apologised at a briefing on the breach and a security overhaul
  5. MSIT confirmed that 368 people were hit by unauthorised carrier-billing payments made through the rogue femtocells · 777 payments, about KRW 243 million
16 more
  1. Free USIM replacement for all customers began, rolled out by region · nationwide from 3 December 2025
  2. CEO told the board he would not seek another term, serving until March 2026
  3. Full-survey results: 20 rogue femtocell IDs, 22,227 people with possible IMSI/IMEI/number exposure, 368 micro-payment victims; leak start revised to October 2024
  4. Third breach report to PIPC after further leaks were found
  5. Second breach report to PIPC after further leaks were found
  6. Server-intrusion report to KISA at 23:57, three days after KT recorded becoming aware of it · 15 September 2025, 14:00
  7. PASS biometric authentication made mandatory for gift-card micro-payments
  8. Free USIM replacement and USIM protection service for about 19,000 customers who received the rogue base station signal · MVNO included
  9. Lookup for whether one was affected, linked in the notice texts
  10. Text messages to the 5,561 customers whose IMSI may have leaked
  11. CEO and executives apologised at a press conference
  12. First breach report to PIPC: 5,561 people
  13. Intrusion report to KISA
  14. KT confirmed that an unregistered rogue femtocell had connected to its internal network
  15. KT blocked abnormal micro-payment attempts
  16. 24-hour dedicated customer centre for misuse reports and micro-payment questions
Company
KT
When it happened
–
Company detected it
Made public
Notice
Leak confirmed
Affected
16,647 people · incl. MVNO, deduplicated; PIPC; 22,227 announced by KT on October 17, 2025; 368 people with unauthorized micropayments · KT

How the facts developed

  1. PIPC decision: 16,647 people; 과징금 539억 7,900만원; criminal complaint (고발) for obstructing the investigation (server log deletion, false submissions)
  2. Second report to PIPC: 20,030 subscribers whose IMSI, IMEI or phone number may have leaked
  3. First report to PIPC: IMSI possibly leaked for 5,561 subscribers

Sources