ENKR

SK Telecom USIM data breach

Add to my breach check

Made public · 23,244,649 people

What leaked9

Replaceable

  • SIM authentication key
  • IMSI

Hard to replace

  • Phone IMEI
  • Mobile number
  • Home or delivery address
  • Email address
  • Other profile data

Permanent

  • Date of birth
  • Full name
  • SIM authentication keyKi, OPc
  • Phone IMEItemporarily stored on the infected ICAS servers; whether it leaked between June 2022 and December 2024 could not be determined · PIPC
  • Other profile dataother internal fields: 25 items in total per PIPC · SKT's own notice listed 21

To-dos10 · about 2 h in all

  1. Block carrier billing or lower its limitabout 5 minStops: carrier billing
  2. Turn on the carrier's USIM protection serviceabout 3 minfreeLimits harm from: carrier billing, SIM swap
  3. Replace the USIM or reissue the eSIMabout 30 minLimits harm from: carrier billing, SIM swap
  4. Know the scam pattern: calls and texts that cite these leaked detailsabout 5 minfreeLimits harm from: scam calls, phishing messages
  5. Block open banking at banks you chooseabout 10 minLimits harm from: scam calls, SMS code theft (opens in a new tab)
5 more
  1. This weekBlock new mobile lines in your name with Msaferabout 10 minfreeLimits harm from: SIM swap (opens in a new tab)
  2. This weekRegister as an exposed person with the FSSabout 10 minLimits harm from: scam calls (opens in a new tab)
  3. This weekBlock new loans and cards in your nameabout 10 minLimits harm from: scam calls (opens in a new tab)
  4. This weekRemove your address and phone from public profiles and tighten SNS privacyabout 20 minfreeLimits harm from: visits or contact at home
  5. When convenientUse an authenticator app or passkey instead of SMS codesabout 20 minfreeLimits harm from: SMS code theft

What happened next57 events

  1. Undetected 2 eventsabout 3 yr 8 mo · show events
  2. Response 25 eventsNotice in 21 days · show events
  3. Remedy 7 eventsEnded · Back to latest
  4. Penalty 15 eventsFine ₩134.8B · show events
  5. Disputes 8 eventsOngoing · show events

Remedy: 7 events

Back to latest
  1. Additional applicants for the collective mediation (three merged group cases) accepted from 4 to 18 SeptemberClosed September 18, 2025
  2. 50 GB of extra data per month provided from August to December 2025Ended December 31, 2025
  3. August mobile bills cut by 50% for 24M SK Telecom and MVNO customers, applied automaticallyEnded August 31, 2025
  4. Fee waiver extended to customers unable to cancel by 14 July (military service, long hospital stay, abroad, remote islands, prison) if they cancel within 10 days of the reason ending
  5. Offered a KRW 500 billion 'customer appreciation package' to about 24M customers (incl. MVNO) as of July 15, 2025: 50% off August bills, 50 GB extra data monthly Aug-Dec, membership discountsEnded December 31, 2025
  6. Termination fees waived for contract customers (as of April 18, 2025 24:00) who cancelled after the breach or cancel by July 14, 2025; refunds on requestEnded July 14, 2025
  7. Agreed with MSIT to compensate 100% of damage suffered by USIM protection service subscribers
Company
SK Telecom
When it happened
–
Company detected it
Made public
Notice
Leak confirmed
Affected
23,244,649 people · LTE/5G incl. MVNO, deduplicated; PIPC; 26.96M records by IMSI · MSIT

How the facts developed

  1. PIPC decision: 23,244,649 people; 과징금 1,347억 9,100만원, 과태료 960만원 (72-hour notice missed)
  2. MSIT final result: 25 items, 9.82 GB; IMEI and some identity fields possibly exposed, not verifiable
  3. Site-wide notice of a presumed partial leak; May 2, 2025 PIPC ordered statutory notification to everyone possibly affected, including MVNO subscribers; individual notices May 9, 2025

Sources