ENKR

SK Telecom USIM data breach

Add to my breach check

Made public · 23,244,649 people

What leaked9

Replaceable

  • SIM authentication key
  • IMSI

Hard to replace

  • Phone IMEI
  • Mobile number
  • Home or delivery address
  • Email address
  • Other profile data

Permanent

  • Date of birth
  • Full name
  • SIM authentication keyKi, OPc
  • Phone IMEItemporarily stored on the infected ICAS servers; whether it leaked between June 2022 and December 2024 could not be determined · PIPC
  • Other profile dataother internal fields: 25 items in total per PIPC · SKT's own notice listed 21

To-dos10 · about 2 h in all

  1. Block carrier billing or lower its limitabout 5 minStops: carrier billing
  2. Turn on the carrier's USIM protection serviceabout 3 minfreeLimits harm from: carrier billing, SIM swap
  3. Replace the USIM or reissue the eSIMabout 30 minLimits harm from: carrier billing, SIM swap
  4. Know the scam pattern: calls and texts that cite these leaked detailsabout 5 minfreeLimits harm from: scam calls, phishing messages
  5. Block open banking at banks you chooseabout 10 minLimits harm from: scam calls, SMS code theft (opens in a new tab)
5 more
  1. This weekBlock new mobile lines in your name with Msaferabout 10 minfreeLimits harm from: SIM swap (opens in a new tab)
  2. This weekRegister as an exposed person with the FSSabout 10 minLimits harm from: scam calls (opens in a new tab)
  3. This weekBlock new loans and cards in your nameabout 10 minLimits harm from: scam calls (opens in a new tab)
  4. This weekRemove your address and phone from public profiles and tighten SNS privacyabout 20 minfreeLimits harm from: visits or contact at home
  5. When convenientUse an authenticator app or passkey instead of SMS codesabout 20 minfreeLimits harm from: SMS code theft

What happened next57 events

  1. Undetected 2 eventsabout 3 yr 8 mo · show events
  2. Response 25 eventsNotice in 21 days · show events
  3. Remedy 7 eventsEnded · show events
  4. Penalty 15 eventsFine ₩134.8B · Back to latest
  5. Disputes 8 eventsOngoing · show events

Penalty: 15 events

Back to latest
  1. SK Telecom filed an administrative suit to cancel the PIPC penalty surcharge
  2. Corrective order to strengthen safety measures and CPO governance, plus a recommendation to extend ISMS-P certification to the mobile network
  3. PIPC found 23,244,649 users' data (25 items incl. Ki/OPc) leaked through basic security failures; the CPO did not oversee network systems
  4. PIPC administrative fine of KRW 9.6 million for late leak notification
  5. PIPC penalty surcharge of KRW 134.791 billion for breaching its duty to take safety measures
10 more
  1. MSIT found late and missing breach reports and a breach of its data-preservation order · two servers altered before handover; a fine and a referral to investigators were announced as planned
  2. MSIT found SK Telecom at fault (plaintext credentials, unreported 2022 incident, unencrypted Ki) and that the termination-fee waiver clause applies
  3. MSIT lifted the new-subscriber suspension from 24 June
  4. Administrative guidance: automatic USIM protection enrolment lacked explicit consent; terms to be amended and users informed
  5. Emergency resolution ordering statutory leak notices to everyone possibly affected, MVNO users included, and protection for vulnerable groups
  6. Administrative guidance: daily briefings, full halt of new-subscriber sign-ups until USIM supply stabilises, review of fee waivers and compensation
  7. MSIT formed a public-private joint investigation team
  8. PIPC opened an investigation the day of the report, with a task force set up with KISA
  9. MSIT and KISA ordered data preservation, sent KISA experts on site and set up an emergency task force
  10. Police moved from preliminary inquiry to a formal investigation with a 22-person team
Company
SK Telecom
When it happened
–
Company detected it
Made public
Notice
Leak confirmed
Affected
23,244,649 people · LTE/5G incl. MVNO, deduplicated; PIPC; 26.96M records by IMSI · MSIT

How the facts developed

  1. PIPC decision: 23,244,649 people; 과징금 1,347억 9,100만원, 과태료 960만원 (72-hour notice missed)
  2. MSIT final result: 25 items, 9.82 GB; IMEI and some identity fields possibly exposed, not verifiable
  3. Site-wide notice of a presumed partial leak; May 2, 2025 PIPC ordered statutory notification to everyone possibly affected, including MVNO subscribers; individual notices May 9, 2025

Sources