ENKR

SK Telecom USIM data breach

Add to my breach check

Made public · 23,244,649 people

What leaked9

Replaceable

  • SIM authentication key
  • IMSI

Hard to replace

  • Phone IMEI
  • Mobile number
  • Home or delivery address
  • Email address
  • Other profile data

Permanent

  • Date of birth
  • Full name
  • SIM authentication keyKi, OPc
  • Phone IMEItemporarily stored on the infected ICAS servers; whether it leaked between June 2022 and December 2024 could not be determined · PIPC
  • Other profile dataother internal fields: 25 items in total per PIPC · SKT's own notice listed 21

To-dos10 · about 2 h in all

  1. Block carrier billing or lower its limitabout 5 minStops: carrier billing
  2. Turn on the carrier's USIM protection serviceabout 3 minfreeLimits harm from: carrier billing, SIM swap
  3. Replace the USIM or reissue the eSIMabout 30 minLimits harm from: carrier billing, SIM swap
  4. Know the scam pattern: calls and texts that cite these leaked detailsabout 5 minfreeLimits harm from: scam calls, phishing messages
  5. Block open banking at banks you chooseabout 10 minLimits harm from: scam calls, SMS code theft (opens in a new tab)
5 more
  1. This weekBlock new mobile lines in your name with Msaferabout 10 minfreeLimits harm from: SIM swap (opens in a new tab)
  2. This weekRegister as an exposed person with the FSSabout 10 minLimits harm from: scam calls (opens in a new tab)
  3. This weekBlock new loans and cards in your nameabout 10 minLimits harm from: scam calls (opens in a new tab)
  4. This weekRemove your address and phone from public profiles and tighten SNS privacyabout 20 minfreeLimits harm from: visits or contact at home
  5. When convenientUse an authenticator app or passkey instead of SMS codesabout 20 minfreeLimits harm from: SMS code theft

What happened next57 events

  1. Undetected 2 eventsabout 3 yr 8 mo · show events
  2. Response 25 eventsNotice in 21 days · show events
  3. Remedy 7 eventsEnded · show events
  4. Penalty 15 eventsFine ₩134.8B · show events
  5. Disputes 8 eventsOngoing · show events
  1. SK Telecom rejected the Korea Consumer Agency mediation decision, so the mediation failed
  2. SK Telecom filed an administrative suit to cancel the PIPC penalty surcharge
  3. Collective mediation decision: KRW 50,000 bill credit plus 50,000 T Plus points per person for 58 applicants, to be extended to all affected users if accepted
  4. SK Telecom rejected the PIPC mediation proposal, so the mediation failed
  5. Mediation proposal: KRW 300,000 per applicant for 3,998 applicants · 3 group cases with 3,267 people, 731 individual
52 more
  1. SK Telecom's CEO replaced in the SK Group executive reshuffle; the new CEO was due to start on 1 November
  2. Additional applicants for the collective mediation (three merged group cases) accepted from 4 to 18 SeptemberClosed September 18, 2025
  3. SK Telecom did not accept the KCC mediation by the reply deadline, so it failed
  4. Corrective order to strengthen safety measures and CPO governance, plus a recommendation to extend ISMS-P certification to the mobile network
  5. PIPC found 23,244,649 users' data (25 items incl. Ki/OPc) leaked through basic security failures; the CPO did not oversee network systems
  6. PIPC administrative fine of KRW 9.6 million for late leak notification
  7. PIPC penalty surcharge of KRW 134.791 billion for breaching its duty to take safety measures
  8. Ex officio mediation: waive termination fees for anyone cancelling in 2025, and pay half the fees on bundled internet/TV products
  9. 50 GB of extra data per month provided from August to December 2025Ended December 31, 2025
  10. August mobile bills cut by 50% for 24M SK Telecom and MVNO customers, applied automaticallyEnded August 31, 2025
  11. Leak lookup for SK Telecom and MVNO users opened in the T World app
  12. Confirmed-leak notices sent
  13. Fee waiver extended to customers unable to cancel by 14 July (military service, long hospital stay, abroad, remote islands, prison) if they cancel within 10 days of the reason ending
  14. DART guidance revision: 2025 revenue outlook cut from KRW 17.8 trillion to KRW 17 trillion and operating profit to decline, citing the KRW 500 billion customer package
  15. Security plan: KRW 700 billion over five years, CISO moved under the CEO, security staff doubled, a 1-year free mobile security app, cyber-insurance cover raised to KRW 100 billion
  16. Offered a KRW 500 billion 'customer appreciation package' to about 24M customers (incl. MVNO) as of July 15, 2025: 50% off August bills, 50 GB extra data monthly Aug-Dec, membership discountsEnded December 31, 2025
  17. Termination fees waived for contract customers (as of April 18, 2025 24:00) who cancelled after the breach or cancel by July 14, 2025; refunds on requestEnded July 14, 2025
  18. The CEO apologised again at the 'Responsibility and Promise' press conference
  19. MSIT found late and missing breach reports and a breach of its data-preservation order · two servers altered before handover; a fine and a referral to investigators were announced as planned
  20. MSIT found SK Telecom at fault (plaintext credentials, unreported 2022 incident, unencrypted Ki) and that the termination-fee waiver clause applies
32 more
  1. Final result: 28 infected servers out of 42,605, 33 malware samples · 27 BPFDoor; 25 USIM items, 9.82 GB, 26.96M records by IMSI; first intrusion August 2021
  2. DART filing on resuming new-subscriber sign-ups
  3. MSIT lifted the new-subscriber suspension from 24 June
  4. SK Telecom said no secondary harm from the breach had occurred so far
  5. 'Cyber breach information' page opened on T World with FAQ, fact checks and the dedicated helpline
  6. Administrative guidance: automatic USIM protection enrolment lacked explicit consent; terms to be amended and users informed
  7. Second interim result: 23 infected servers, 25 malware samples; two servers temporarily holding personal data were infected
  8. Joint damages suit by 9,175 subscribers at Seoul Central District Court, KRW 500,000 each · about KRW 4.6 billion
  9. Enrolment of all domestic and roaming customers in the USIM protection service completed · automatic enrolment from 2 May
  10. Individual notices of a possible leak sent, after the PIPC order and past the 72-hour statutory deadline
  11. The SK Group chairman apologised on behalf of the group at the daily briefing
  12. Voluntary DART filing on the suspension of new-subscriber sign-ups
  13. New-subscriber sign-ups suspended under MSIT guidance to prioritise USIM replacement
  14. Emergency resolution ordering statutory leak notices to everyone possibly affected, MVNO users included, and protection for vulnerable groups
  15. Administrative guidance: daily briefings, full halt of new-subscriber sign-ups until USIM supply stabilises, review of fee waivers and compensation
  16. Damages suit at Seoul Central District Court claiming KRW 3 million per person
  17. First interim result: 5 servers examined, 25 USIM data items leaked, 4 BPFDoor-family malware samples, no IMEI leak
  18. Free USIM (and eSIM) replacement for all subscribers as of April 18, 2025 24:00, at T World stores and airport roaming centres; self-paid replacements from 19 to 27 April refunded
  19. Agreed with MSIT to compensate 100% of damage suffered by USIM protection service subscribers
  20. The CEO apologised at a press briefing
12 more
  1. MSIT formed a public-private joint investigation team
  2. Free USIM protection service offered to customers who want extra protection
  3. Dedicated customer centre number 080-800-0577 for breach enquiries
  4. Website notice of a suspected leak of some USIM-related data, with an apology
  5. PIPC opened an investigation the day of the report, with a task force set up with KISA
  6. Personal data leak reported to the PIPC
  7. MSIT and KISA ordered data preservation, sent KISA experts on site and set up an emergency task force
  8. Breach reported to KISA at 16:46, after the 24-hour deadline · MSIT
  9. SK Telecom noticed unusually large data transfers leaving its network at 23:20
  10. Police moved from preliminary inquiry to a formal investigation with a 22-person team
  11. Malware deleted and suspected hacked equipment isolated after the leak was noticed
  12. Intrusion began
Company
SK Telecom
When it happened
–
Company detected it
Made public
Notice
Leak confirmed
Affected
23,244,649 people · LTE/5G incl. MVNO, deduplicated; PIPC; 26.96M records by IMSI · MSIT

How the facts developed

  1. PIPC decision: 23,244,649 people; 과징금 1,347억 9,100만원, 과태료 960만원 (72-hour notice missed)
  2. MSIT final result: 25 items, 9.82 GB; IMEI and some identity fields possibly exposed, not verifiable
  3. Site-wide notice of a presumed partial leak; May 2, 2025 PIPC ordered statutory notification to everyone possibly affected, including MVNO subscribers; individual notices May 9, 2025

Sources