ENKR

SK Telecom USIM data breach

Add to my breach check

Made public · 23,244,649 people

What leaked9

Replaceable

  • SIM authentication key
  • IMSI

Hard to replace

  • Phone IMEI
  • Mobile number
  • Home or delivery address
  • Email address
  • Other profile data

Permanent

  • Date of birth
  • Full name
  • SIM authentication keyKi, OPc
  • Phone IMEItemporarily stored on the infected ICAS servers; whether it leaked between June 2022 and December 2024 could not be determined · PIPC
  • Other profile dataother internal fields: 25 items in total per PIPC · SKT's own notice listed 21

To-dos10 · about 2 h in all

  1. Block carrier billing or lower its limitabout 5 minStops: carrier billing
  2. Turn on the carrier's USIM protection serviceabout 3 minfreeLimits harm from: carrier billing, SIM swap
  3. Replace the USIM or reissue the eSIMabout 30 minLimits harm from: carrier billing, SIM swap
  4. Know the scam pattern: calls and texts that cite these leaked detailsabout 5 minfreeLimits harm from: scam calls, phishing messages
  5. Block open banking at banks you chooseabout 10 minLimits harm from: scam calls, SMS code theft (opens in a new tab)
5 more
  1. This weekBlock new mobile lines in your name with Msaferabout 10 minfreeLimits harm from: SIM swap (opens in a new tab)
  2. This weekRegister as an exposed person with the FSSabout 10 minLimits harm from: scam calls (opens in a new tab)
  3. This weekBlock new loans and cards in your nameabout 10 minLimits harm from: scam calls (opens in a new tab)
  4. This weekRemove your address and phone from public profiles and tighten SNS privacyabout 20 minfreeLimits harm from: visits or contact at home
  5. When convenientUse an authenticator app or passkey instead of SMS codesabout 20 minfreeLimits harm from: SMS code theft

What happened next57 events

  1. Undetected 2 eventsabout 3 yr 8 mo · show events
  2. Response 25 eventsNotice in 21 days · Back to latest
  3. Remedy 7 eventsEnded · show events
  4. Penalty 15 eventsFine ₩134.8B · show events
  5. Disputes 8 eventsOngoing · show events

Response: 25 events

Back to latest
  1. SK Telecom's CEO replaced in the SK Group executive reshuffle; the new CEO was due to start on 1 November
  2. Leak lookup for SK Telecom and MVNO users opened in the T World app
  3. Confirmed-leak notices sent
  4. DART guidance revision: 2025 revenue outlook cut from KRW 17.8 trillion to KRW 17 trillion and operating profit to decline, citing the KRW 500 billion customer package
  5. Security plan: KRW 700 billion over five years, CISO moved under the CEO, security staff doubled, a 1-year free mobile security app, cyber-insurance cover raised to KRW 100 billion
20 more
  1. The CEO apologised again at the 'Responsibility and Promise' press conference
  2. Final result: 28 infected servers out of 42,605, 33 malware samples · 27 BPFDoor; 25 USIM items, 9.82 GB, 26.96M records by IMSI; first intrusion August 2021
  3. DART filing on resuming new-subscriber sign-ups
  4. SK Telecom said no secondary harm from the breach had occurred so far
  5. 'Cyber breach information' page opened on T World with FAQ, fact checks and the dedicated helpline
  6. Second interim result: 23 infected servers, 25 malware samples; two servers temporarily holding personal data were infected
  7. Enrolment of all domestic and roaming customers in the USIM protection service completed · automatic enrolment from 2 May
  8. Individual notices of a possible leak sent, after the PIPC order and past the 72-hour statutory deadline
  9. The SK Group chairman apologised on behalf of the group at the daily briefing
  10. Voluntary DART filing on the suspension of new-subscriber sign-ups
  11. New-subscriber sign-ups suspended under MSIT guidance to prioritise USIM replacement
  12. First interim result: 5 servers examined, 25 USIM data items leaked, 4 BPFDoor-family malware samples, no IMEI leak
  13. Free USIM (and eSIM) replacement for all subscribers as of April 18, 2025 24:00, at T World stores and airport roaming centres; self-paid replacements from 19 to 27 April refunded
  14. The CEO apologised at a press briefing
  15. Free USIM protection service offered to customers who want extra protection
  16. Dedicated customer centre number 080-800-0577 for breach enquiries
  17. Website notice of a suspected leak of some USIM-related data, with an apology
  18. Personal data leak reported to the PIPC
  19. Breach reported to KISA at 16:46, after the 24-hour deadline · MSIT
  20. Malware deleted and suspected hacked equipment isolated after the leak was noticed
Company
SK Telecom
When it happened
–
Company detected it
Made public
Notice
Leak confirmed
Affected
23,244,649 people · LTE/5G incl. MVNO, deduplicated; PIPC; 26.96M records by IMSI · MSIT

How the facts developed

  1. PIPC decision: 23,244,649 people; 과징금 1,347억 9,100만원, 과태료 960만원 (72-hour notice missed)
  2. MSIT final result: 25 items, 9.82 GB; IMEI and some identity fields possibly exposed, not verifiable
  3. Site-wide notice of a presumed partial leak; May 2, 2025 PIPC ordered statutory notification to everyone possibly affected, including MVNO subscribers; individual notices May 9, 2025

Sources