South Korea Fines Telecom KT $39 Million Over Data Breach

South Korea's Personal Information Protection Commission (PIPC) has fined KT Corporation 53.979 billion won (about $39 million) for information-security violations. KT is the country's largest telecom operator: 23,300 employees, more than 13.5 million mobile subscribers, 90% of fixed-line telephony and 45% of the broadband market.

The rogue cell

The breach lasted almost 11 months — from October 8, 2024 to September 5, 2025. The point of entry was a lost KT femtocell, a miniature base station that stored a valid authentication certificate inside. The attackers extracted the certificate and installed it on a homemade device, which KT's network accepted as a legitimate node. The rogue cell intercepted traffic from nearby phones: numbers, IMSI and IMEI identifiers, and later the SMS and ARS codes that confirm mobile micropayments.

The investigation began on September 10, 2025 after users complained about fraudulent charges. KT initially reported a data breach affecting roughly 5,500 customers, but the PIPC determined that 16,647 subscribers had been affected, and at least 368 of them had a combined 240 million won (about $167,400) stolen.

The regulator judged KT's protections inadequate: femtocell certificates were valid for ten years, connections were not restricted by source IP address, and a separate route existed that bypassed the management server. All of this allowed the attackers to remain in the network undetected for nearly a year.

BPFDoor and wiped logs

During the review a second, earlier incident surfaced. Back in March 2024, 38 KT servers had been infected with malware, including BPFDoor — a stealthy backdoor for Linux and Solaris that was publicly documented in 2022 and had evaded detection for years. PwC researchers linked it to the Chinese espionage group Red Menshen, which hunts for telecom operators. BPFDoor uses Berkeley Packet Filter technology: it passively listens to traffic and activates on special “magic” packets, without opening ports and bypassing firewalls.

According to the commission, KT knew about the infection as of March 2024 but did not notify the authorities and handled the incident internally. Worse, during the review the company deleted logs from some of the compromised servers. Another operator, LG U+, acted similarly — reinstalling operating systems and disposing of servers before investigators arrived. Because of the wiped logs, the PIPC was ultimately unable to establish whether any further volume of data had been stolen.

As part of its orders, KT was required to strengthen the protection of femtocells and other equipment, put privacy management in order, grant real authority to its data protection officer, and extend ISMS-P certification to the mobile network. At the same time, the PIPC pledged to push for amendments to the law introducing tough penalties for concealing or destroying evidence before and during investigations.

Source: Bleeping Computer