KT fined KRW 53.979B over a rogue femtocell data breach
₩54B
≈ $39M at the time
Personal Information Protection Commission
South Korea · 2026
Status: Not yet final
What happened
South Korea's PIPC found that hackers extracted authentication credentials from KT's femtocells, loaded them into rogue femtocells and used them to reach KT's network, intercepting traffic between subscribers' phones and the network from October 2024 to September 2025. The commission held that KT owned and operated the femtocells and failed to apply baseline access controls to its internal network.
The PIPC also referred LG Uplus to an investigative authority for tampering with evidence in a related matter. The release is the PIPC's own unofficial English translation. KT can contest the fine at an administrative court; no such suit had been reported when this entry was verified.
How it affected users
Mobile phone numbers, IMSI and IMEI identifiers of 16,647 subscribers, including budget carrier users, were leaked. 368 of them suffered fraudulent mobile payments totalling about KRW 240 million, made by intercepting payment authentication codes sent by call or text.
Status timeline
Jul 30, 2026
The PIPC announced an administrative fine of KRW 53.979B, a correction order, a recommendation for improvement and a publication order, and resolved to accuse KT of obstructing its investigation.
Sources
- PIPC press release: The PIPC Sanctions KT Corporation for Data Breachesregulator
- BleepingComputer: South Korea fines telco giant KT $39 million for customer data breachnews
Last verified 2026-10-29. Spotted an error? Report a correction.
Cite this entry
Deepak Gupta, "KT fined KRW 53.979B over a rogue femtocell data breach," Tech Fines Directory, guptadeepak.com, 2026-07-30. https://guptadeepak.com/tech-fines/violation/kt-southkorea-pipc-2026/