Telecom

South Korea's PIPC found that hackers extracted authentication credentials from KT's femtocells, loaded them into rogue femtocells and used them to reach KT's network, intercepting traffic between subscribers' phones and the network from October 2024 to September 2025. The commission held that KT owned and operated the femtocells and failed to apply baseline access controls to its internal network.

The CNIL found that Free Mobile's security was inadequate for the volume and sensitivity of its data, with weak authentication on the VPN used for remote work and ineffective detection of abnormal activity, after an attacker reached its systems in October 2024. It also found that the breach notice sent to subscribers lacked required information, and that Free Mobile kept millions of former subscribers' records for an excessive period.

The CNIL found that Free, the broadband operator, did not secure its subscribers' data to a level matching its volume and sensitivity, with weak VPN authentication and ineffective detection of abnormal activity, after an attacker reached the systems of Free and Free Mobile in October 2024. It also found that the breach notice sent to subscribers lacked required information on the consequences and on how to protect themselves.