South Korea Fines SK Telecom $96.5M Over Massive Data Breach

In April 2025, South Korea’s leading telecommunications provider SK Telecom (SKT) uncovered a long-standing software vulnerability that had allowed attackers to lurk within its internal systems for years, with some researchers believing the intrusion may have begun as early as August 2021. The cybercriminals targeted SKT’s Home Subscriber Servers and other critical infrastructure, stealing sensitive customer data including USIM authentication keys, IMSI, IMEI device identifiers, phone numbers, and email addresses.

The breach affected approximately 27 million South Korean users out of SKT’s total subscriber base of about 30 million. The Personal Information Protection Commission imposed a record fine of 134 billion won (approximately $96.53 million USD).

Regulators noted that SKT failed to uphold its duty to implement adequate security safeguards and delayed disclosing the breach to customers, with attackers able to access the internal network directly from the public internet and several servers lacking passwords or basic protections.

SKT has been ordered to strengthen its governance and compliance structures in line with enhanced information protection regulations, and the company says data protection will be treated as its highest priority according to the article.