KT fined $37.4 mil. over data leak via illegal base stations

A person walks by a KT store in Seoul, Wednesday. Yonhap

Korea's privacy watchdog said Thursday it has fined wireless carrier KT Corp. 53.9 billion won ($37.4 million) over a major data breach that affected more than 16,000 users.

The Personal Information Protection Commission also ordered KT to take corrective measures over the breach into the company's wireless network through unauthorized mobile base stations.

The breach, first reported by the company in September, affected phone numbers and mobile device identification numbers of 16,647 users, according to the regulator.

Malicious actors then used the information to carry out unauthorized transactions, leading to losses of 240 million won in total for 368 victims.

The watchdog said the hackers went unnoticed while they accessed KT's wireless network between Oct. 8, 2024, and Sept. 5, 2025, adding the company only realized the breach had occurred after a user complaint.

The hackers had gained access to the network by building illegal base stations using authentication certificates extracted from base stations KT had lost.

The regulator ordered the company to strengthen security measures for its wireless network equipment and its personal information protection measures.

The watchdog also decided to file a complaint with police against KT for obstructing its investigation into a separate hacking accident in March 2024 that the company did not report to the authorities.

The company initially denied keeping records of the incident, in which its servers were infected with malicious code, but later handed them over after the regulator found signs of evidence tampering.

It separately decided to refer another telecom operator, LG Uplus Corp., to the police for investigation on suspicion of obstruction of official duties after determining the company had covered up or destroyed records of a data leak.

The watchdog had launched a probe into the company after an online cybersecurity publication reported the leak in August. The regulator, however, found the company had destroyed servers to make it difficult to determine how the leak exactly occurred.