SK in damage-control mode after data breach, sets up new committee

Signs apologizing for SK Telecom's recent hacking incident are posted on a SK Telecom shop in Seoul on May 7. Yonhap

SK Group said Wednesday it has established the Information Security Innovation Committee (ISIC), which includes external experts, as part of its attempt to contain the fallout from a major data breach at its mobile carrier unit, SK Telecom.

ISIC, which will act as an independent organization, will become the ninth committee of the SUPEX Council, SK’s highest consultative panel serving as the group's control tower. The newest committee has invited experts across academia and industry and is designated to detect and prevent security risks, and strengthen security across its subsidiaries, the group said.

Chey Chang-won, chairman of the SUPEX Council, will head the new committee, with key SK Group affiliates, including SK Corp., SK Innovation, SK hynix and SK Telecom, participating.

Professor Kwon Hun-yeong of Korea University, former chairman of the Presidential Committee on the Digital Platform Government, will serve as the chairman of the external advisory.

The committee also includes prominent experts in information security and cybersecurity, such as Professor Choi Kyung-jin of Gachon University, Professor Lee Byung-young of Seoul National University and Professor Kim Yong-dae of the Korea Advanced Institute of Science & Technology.

"With the establishment of the ISIC, we will enhance the security level across all SK Group companies and strengthen systematic information protections to build trust with stakeholders," the group said in a release. "We will maximize its implementation by operating monthly regular meetings and technical meetings."

The committee was set up as part of SK Group Chairman Chey Tae-won's pledge last week that the group would set up a committee dedicated to information security to prevent the recurrence of the data breach, which could have exposed the personal data of approximately 25 million SK Telecom users.

SK Telecom announced on April 22 that it detected a malware attack on April 18 and found signs of a large-scale leak of customers’ universal subscriber identity module (USIM) data. Since then, the telecom has been engaging in damage control, offering free USIM replacements for all 25 million customers since April 28 and suspending all new subscriptions from May 5, following government guidance.

The new committee's first task will be a mock hacking, which will be conducted across all group companies. It will check and supplement system vulnerabilities using actual hacking techniques by top security companies that have received awards from local and international hacking competitions.

Additionally, the committee will reassess SK Telecom's information security system and reorganize it to meet global standards, conducting verification from an outside party.