ENKR

SK Telecom USIM data breach

Add to my breach check

Made public · 23,244,649 people

What leaked9

Replaceable

  • SIM authentication key
  • IMSI

Hard to replace

  • Phone IMEI
  • Mobile number
  • Home or delivery address
  • Email address
  • Other profile data

Permanent

  • Date of birth
  • Full name
  • SIM authentication keyKi, OPc
  • Phone IMEItemporarily stored on the infected ICAS servers; whether it leaked between June 2022 and December 2024 could not be determined · PIPC
  • Other profile dataother internal fields: 25 items in total per PIPC · SKT's own notice listed 21

To-dos10 · about 2 h in all

  1. Block carrier billing or lower its limitabout 5 minStops: carrier billing
  2. Turn on the carrier's USIM protection serviceabout 3 minfreeLimits harm from: carrier billing, SIM swap
  3. Replace the USIM or reissue the eSIMabout 30 minLimits harm from: carrier billing, SIM swap
  4. Know the scam pattern: calls and texts that cite these leaked detailsabout 5 minfreeLimits harm from: scam calls, phishing messages
  5. Block open banking at banks you chooseabout 10 minLimits harm from: scam calls, SMS code theft (opens in a new tab)
5 more
  1. This weekBlock new mobile lines in your name with Msaferabout 10 minfreeLimits harm from: SIM swap (opens in a new tab)
  2. This weekRegister as an exposed person with the FSSabout 10 minLimits harm from: scam calls (opens in a new tab)
  3. This weekBlock new loans and cards in your nameabout 10 minLimits harm from: scam calls (opens in a new tab)
  4. This weekRemove your address and phone from public profiles and tighten SNS privacyabout 20 minfreeLimits harm from: visits or contact at home
  5. When convenientUse an authenticator app or passkey instead of SMS codesabout 20 minfreeLimits harm from: SMS code theft

What happened next57 events

  1. Undetected 2 eventsabout 3 yr 8 mo · show events
  2. Response 25 eventsNotice in 21 days · show events
  3. Remedy 7 eventsEnded · show events
  4. Penalty 15 eventsFine ₩134.8B · show events
  5. Disputes 8 eventsOngoing · Back to latest

Disputes: 8 events

Back to latest
  1. SK Telecom rejected the Korea Consumer Agency mediation decision, so the mediation failed
  2. Collective mediation decision: KRW 50,000 bill credit plus 50,000 T Plus points per person for 58 applicants, to be extended to all affected users if accepted
  3. SK Telecom rejected the PIPC mediation proposal, so the mediation failed
  4. Mediation proposal: KRW 300,000 per applicant for 3,998 applicants · 3 group cases with 3,267 people, 731 individual
  5. SK Telecom did not accept the KCC mediation by the reply deadline, so it failed
3 more
  1. Ex officio mediation: waive termination fees for anyone cancelling in 2025, and pay half the fees on bundled internet/TV products
  2. Joint damages suit by 9,175 subscribers at Seoul Central District Court, KRW 500,000 each · about KRW 4.6 billion
  3. Damages suit at Seoul Central District Court claiming KRW 3 million per person
Company
SK Telecom
When it happened
–
Company detected it
Made public
Notice
Leak confirmed
Affected
23,244,649 people · LTE/5G incl. MVNO, deduplicated; PIPC; 26.96M records by IMSI · MSIT

How the facts developed

  1. PIPC decision: 23,244,649 people; 과징금 1,347억 9,100만원, 과태료 960만원 (72-hour notice missed)
  2. MSIT final result: 25 items, 9.82 GB; IMEI and some identity fields possibly exposed, not verifiable
  3. Site-wide notice of a presumed partial leak; May 2, 2025 PIPC ordered statutory notification to everyone possibly affected, including MVNO subscribers; individual notices May 9, 2025

Sources