SK Telecom users' USIM data leaked in cyberattack

SK Telecom's headquarters in Jung District, Seoul / Yonhap

SK Telecom, one of Korea’s major mobile carriers, announced Tuesday that it was hit by a hacking attack that exposed user data.

According to the company, some customer information related to subscriber identity modules (USIM) was leaked around 11 p.m. Saturday due to malicious code.

“We are still trying to identify the exact cause, scale and categories of the leak,” the company said in a press statement.

“To comply with related laws, we immediately reported the security breach to the Korea Internet & Security Agency (KISA) on Sunday.”

SK Telecom CEO Ryu Young-sang expressed deep regret and a strong sense of responsibility in a message to employees, saying, "As CEO, I feel deep regret and responsibility."

He also called on staff to make every effort to strengthen the company's security system and implement robust measures to protect customer information.

As for the potential leak of personal information other than USIM code data, the company said the matter is still under investigation.

The company added that it reported the circumstances of the personal information leak to the Personal Information Protection Commission, the national data protection authority, on Tuesday morning, and is "actively cooperating" with the ongoing investigation.

It noted that it had immediately deleted the malicious code upon detecting a potential leak and removed the suspected compromised equipment. It added that, as of Tuesday, there had been no confirmed cases of the leaked information being misused.

Despite the breach, the company said it will implement new measures to protect users. These include comprehensive system inspections and improved blocking systems for illegal SIM transfers and suspicious authentication attempts. The company also plans to strengthen its suspension and notification protocols when signs of potential damage are detected.

SK added that it is providing a free SIM protection service via its website and T World for customers who wish to implement additional security measures.

“We will further strengthen our security system to prevent similar incidents from recurring and do our utmost to establish customer information protection measures,” it said. “Once again, we sincerely apologize for causing concern to our customers.”

Considering the severity of the personal information leak, the Ministry of Science and ICT has formed an emergency response team in coordination with its Cyber Security and Network Policy Bureau. The ministry has also demanded that the company preserve and submit materials related to the cyberattack. Officials from KISA have been dispatched to investigate the circumstances of the incident.

The ministry launched an on-site investigation of the company’s internal systems at SK Telecom’s headquarters in central Seoul on Tuesday.

If needed, the ministry will also form a public and private joint investigation team to carry out an in-depth analysis of the causes and establish preventive measures for the future.

If the investigation determines that SK Telecom had issues with its security management, the authorities may issue corrective work orders.