\n<\/p>\n
In April, South Korea\u2019s telco giant SK Telecom (SKT) was hit by a cyberattack that led to the theft of personal data on approximately 23 million customers, equivalent to almost half of the country\u2019s 52 million residents.<\/p>\n
At a National Assembly hearing in Seoul on Thursday, SKT chief executive Young-sang Ryu said about 250,000 users have switched to a different telecom provider following the data breach. He said he expects this number to reach 2.5 million, more than tenfold the current amount, if the company waives cancellation fees.<\/p>\n
The company could lose up to $5 billion (around \u20a97 trillion) over the next three years if it decides not to charge cancellation fees for users who want to cancel their contract early, Ryu said at the hearing.<\/p>\n
\u201cSK Telecom considers this incident the most severe security breach in the company\u2019s history and is putting forth our utmost effort to minimize any damage to our customers,\u201d a spokesperson at SKT told TechCrunch in an emailed statement. \u201cThe number of customers affected and the entity responsible for the hacking is under investigation,\u201d the spokesperson added.<\/p>\n
A joint investigation involving both public and private entities is currently underway to identify the specific cause of the incident.\u00a0<\/p>\n
The Personal Information Protection Committee (PIPC)<\/a> of South Korea announced<\/a> on Thursday<\/a> that 25 different types of personal information, including mobile phone numbers and unique identifiers (IMSI numbers), as well as USIM authentication keys and other USIM data, had been exfiltrated from its central database, known as its home subscriber server. The compromised data can put customers at greater risk of SIM swapping attacks<\/a> and government surveillance.<\/p>\n After its official announcement of the incident on April 22<\/a>, SKT has been offering SIM card protection and free SIM card replacements to prevent further damage to its customers.<\/p>\n \u201cWe detected possible information leakage regarding SIM on April 19,\u201d the spokesperson at SKT told TechCrunch. \u201cFollowing the identification of the breach, we immediately isolated the affected device while thoroughly investigating the entire system.\u201d<\/p>\n \u201cTo further safeguard our customers, we are currently developing a system that can protect users\u2019 information through the SIM protection service while allowing them to use roaming services seamlessly outside of Korea by May 14,\u201d the spokesperson said.<\/p>\n To date, SKT has not received any reports of secondary damage and no verified instances of customer information being distributed or misused on the dark web or other platforms, the company told TechCrunch.<\/p>\n SKT detected abnormal activities on April 18 at 11:20 p.m.<\/a> local time. SKT found unusual logs and signs of files having been deleted on equipment that the company uses for monitoring and managing billing information for its customers, including data usage and call durations.<\/p>\n The company identified a data breach on April 19 in its home subscriber server in Seoul, which typically houses subscriber information, including authentication, authorization, location, and mobility details.<\/p>\n SKT reported the cyberattack incident to <\/a>Korea\u2019s cybersecurity agency<\/a>.<\/p>\n SKT confirmed on its website<\/a> that it detected suspicious activity, indicating a \u201cpotential\u201d data breach involving some information related to users\u2019 USIMs data.<\/p>\n SKT began replacing mobile SIM cards of 23 million users, but the company has faced\u00a0shortages in obtaining sufficient USIM cards<\/a> to fulfill its promise to provide free SIM card replacements.<\/p>\n South Korean police began investigating <\/a>SKT\u2019s suspected cyberattack on April 18.<\/p>\n According to local media reports<\/a>, many South Korean companies, including SKT, use Ivanti VPN equipment, and that the recent data breach may be connected to China-backed hackers.\u00a0\u00a0<\/p>\n Per a local media report<\/a>, SKT said it received a cybersecurity notice from KISA<\/a> instructing the company to turn off and replace the Ivanti VPN.<\/p>\n TeamT5, a cybersecurity company based in Taiwan, alerted the public to the worldwide threats posed<\/a> by a government-backed group<\/a> linked to China, which allegedly took advantage of vulnerabilities in Ivanti\u2019s Connect Secure VPN systems to gain access to multiple organizations globally.\u00a0<\/p>\n Some 20 industries have been affected, including automotive, chemical, financial institutions, law firms, media, research institutes, and telecommunications, across 12 countries, including Australia, South Korea, Taiwan, and the United States.<\/p>\n A team of public and private investigators discovered an additional eight types of malware<\/a> in SKT\u2019s hacking case. The team is currently investigating whether the new malware was installed on the same home subscriber server as the original four strains or if they are located on separate server equipment.<\/p>\nA timeline of SKT\u2019s data breach<\/h2>\n
April 18, 2025<\/strong><\/h3>\n
April 19, 2025<\/strong><\/h3>\n
April 20, 2025<\/strong><\/h3>\n
April 22, 2025<\/h3>\n
April 28, 2025<\/strong><\/h3>\n
April 30, 2025<\/h3>\n
May 1, 2025\u00a0\u00a0<\/h3>\n
May 6, 2025\u00a0\u00a0<\/h3>\n
May 7, 2025\u00a0\u00a0<\/h3>\n