cyber.hendryadrian.com
Cyber Attack & Data Breach · bleepingcomputer.com

South Korea Fines KT $39 Million Over Subscriber Data Breach and Fraudulent Payments

· Original article ↗

Summary

South Korea’s PIPC fined KT KRW 53.979 billion ($39 million) after finding an 11-month network compromise exposed 16,647 subscribers’ data and enabled KRW 240 million in fraudulent payments. Investigators also found BPFDoor infections and deleted logs.

Key points

  • South Korea’s PIPC fined KT KRW 53.979 billion after its investigation found data protection failures and an internal network compromise lasting nearly 11 months.
  • Attackers used a certificate from a lost KT femtocell on a rogue device to intercept traffic between nearby phones and KT’s core network.
  • The incident exposed information belonging to 16,647 subscribers and enabled KRW 240 million in fraudulent mobile payments for at least 368 people.
  • PIPC also found 38 KT IT service network servers compromised by malware, including BPFDoor, in March 2024; it alleges KT knew of the infection but did not report it.
  • KT deleted historical logs from some compromised servers during malware inspection. PIPC said it could not determine whether additional customer data had been stolen.
  • PIPC ordered KT to strengthen controls over femtocells and other telecom equipment, improve privacy oversight, and extend ISMS-P certification to mobile network systems.

Article Details

Victim Organization
KT Corporation
Incident Type
Internal network compromise through a rogue femtocell, with a separate BPFDoor malware infection discovered on KT servers.
Incident Date
2024-10-08
Disclosure Date
2025-09-11
Data Types Exposed
  • Personal information
  • Mobile phone numbers
  • IMSI numbers
  • IMEI numbers
  • SMS and ARS authentication codes
Affected Records
16,647 KT subscribers
Operational Impact
The compromise persisted until 2025-09-05. Fraudulent mobile payments totaling KRW 240 million were reported for at least 368 subscribers. Investigators also found 38 KT IT service network servers compromised by malware, including BPFDoor, in March 2024. KT's deletion of historical network logs prevented investigators from determining whether additional customer data had been stolen.
Claim Status
confirmed

MITRE ATT&CK

T1040 · Network SniffingThe rogue femtocell captured cellular traffic, including subscriber identifiers and authentication codes.T1557 · Adversary-in-the-MiddleAttackers used a self-made device with a retrieved femtocell certificate to intercept communications between users' devices and KT's core network.

Threat Actors

Red MenshenPwC linked BPFDoor use to the China-nexus espionage group, which the article says targeted telecommunications providers and organizations in other critical sectors. The article does not explicitly attribute the BPFDoor infection at KT to Red Menshen.

Malware

BPFDoorThe investigation also found a separate BPFDoor malware infection on KT servers and cited evidence deletion that may have hidden the full extent of the breach.

Countries

South KoreaSouth Korea’s PIPC fined KT Corporation KRW 53.979 billion after an internal network compromise and data protection failures exposed subscriber information and enabled fraudulent mobile payments.

Industries

TelecommunicationsSouth Korea’s Personal Information Protection Commission (PIPC) has fined telecommunications giant KT Corporation KRW 53.979 billion ($39 million) over data protection violations.

Related Articles