KT Corp fined 540 billion won for data breach via illegal femtocells

KT Corp femtocell breach personal data leak 539.8 billion won fine South Korea regulator

South Korea’s Personal Information Protection Commission imposed a fine of roughly 539.8 billion won (about $37‑38 million) on telecom operator KT Corp for a large‑scale personal data breach. Hackers exploited unsecured femtocell base stations to access the network from October 2024 to September 2025, leaking phone numbers, IMSI and IMEI data of 16,647 subscribers. The stolen information was used in unauthorized mobile‑payment transactions that harmed 368 users, causing losses of about 240 million won.

The regulator also cited KT’s failure to report a March 2025 malware infection, obstruction of the investigation, and the deletion of server logs. It ordered KT to strengthen security of its wireless‑network equipment, expand its personal‑information‑protection management system, and comply with corrective measures. The commission referred KT for criminal investigation and similarly referred LG U+ for alleged evidence tampering.

The fine is lower than the 1.348 trillion won penalty previously levied on SK Telecom for a similar breach, reflecting the regulator’s new policy that allows fines up to 10 % of a company’s annual revenue for serious privacy violations.

Entities: Coupang · KT Corp · KT Corp. · LG Uplus Corp · Personal Information Protection Commission · SK Telecom · South Korea · femtocell base stations

Claims

What the coverage asserts, and how well corroborated each claim is across sources.

[● 6 SOURCES] The regulator also referred LG U+ for possible obstruction of duties after it allegedly destroyed evidence related to a separate data‑leak investigation. (multiple)
[● 6 SOURCES] The Personal Information Protection Commission ordered KT to strengthen security of its wireless‑network equipment and expand its personal‑information‑protection management system. (multiple)
[● 7 SOURCES] Unauthorized mobile‑payment transactions resulting from the breach affected 368 users, causing losses of about 240 million won. (multiple)
[● 6 SOURCES] KT was referred for criminal investigation for obstructing the regulator’s probe, including failure to report a March 2025 malware infection and deletion of server logs. (multiple)
[● 2 SOURCES] The fine imposed on KT is lower than the 1.348 trillion won penalty previously levied on SK Telecom for a similar breach. (3813cf6f-9868-4731-bd2a-f29860ee407c, 12484b33-bddf-4e59-b055-d2766ee65a85)
[● 7 SOURCES] KT Corp was fined approximately 539.8 billion won by South Korea’s Personal Information Protection Commission for a data breach. (3813cf6f-9868-4731-bd2a-f29860ee407c, b0f70986-88a8-4330-8717-23b2c3fc0128, ae1d0fe0-82c5-4f1b-9694-c2ec8091015a, cc808e)
[● 7 SOURCES] The breach exposed personal data of 16,647 KT subscribers, including phone numbers, IMSI and IMEI identifiers. (multiple)