SK Telecom ran one flat, unpatched network — Korea fined it a record ₩134.8bn

On 27 August 2025 Korea's Personal Information Protection Commission (PIPC) fined SK Telecom, the country's largest telco, ₩134.79bn — the largest fine PIPC had ever imposed, previously Google's ₩69.2bn in 2022 — plus a ₩9.6m penalty, for violations that left 23,244,649 LTE and 5G users (including MVNO customers) exposed. The stolen data covered 25 fields: phone numbers, subscriber IDs (IMSI) and the USIM authentication keys used to secure phone identity, of which 26,144,363 records were stored in plaintext.

Hackers first breached SKT's internal network in August 2021 and planted malware; in June 2022 they added a foothold in the ICAS customer-authentication system; in April 2025 they exfiltrated 9.82GB from the HSS home-subscriber database. PIPC found SKT ran internet, management, core and internal networks as one flat network, never restricted management servers' access to HSS, ignored intrusion-detection logs — including a February 2022 hacker login it noticed and did not chase — and stored 4,899 account passwords for ~2,365 servers without encryption.

The most damning finding: SKT installed an operating system carrying the 'Dirty Cow' vulnerability in November 2016, five weeks after CVE-2016-5195 was publicly patched, and never updated it before the April 2025 leak; it ran no antivirus until then despite products detecting the exploit since 2020. It also stored USIM keys (Ki) in plaintext although LG U+ (since 2011) and KT (since 2014) had encrypted theirs — SKT had reviewed the option in 2022 and declined. The company's CPO covered only the IT/web domain, not the telecom infrastructure that was breached.

PIPC judged the conduct '매우 중대한 위반행위' (a very serious violation), added weight for violations lasting 2+ years, then reduced the fine for corrective actions and victim-compensation efforts. It ordered system-wide remediation, extension of ISMS-P certification to telecom-network systems, and a recurrence-prevention plan within 3 months.

Record ₩134.79bn fine plus ₩9.6m penalty and corrective orders; 23,244,649 customers' phone numbers, IMSI numbers and USIM authentication keys (Ki, OPc) stolen

Treating security as an infrastructure cost rather than a product decision put USIM keys — the core of mobile identity — at a level of protection below what two direct competitors had already adopted

A flat single network meant no internal boundary existed between the internet, management, core and internal networks, converting one SQL injection class of failure into a whole-network breach

Knowing about the February 2022 intrusion and the 2016 patch gap for years and acting on neither turned a foreseeable incident into a four-year campaign with a record fine

Delayed notification (May 'possibility', July 'confirmed' notices versus the 72-hour duty) turned a data incident into a separate legal violation and public trust rupture

Competitors already encrypted the same keys; a four-year-old patch and one shared network were the actual breach — the fine was the invoice for not copying peers' security basics

SKT accepted the decision with 'heavy responsibility' but said its arguments were not reflected. PIPC ordered SKT to give the CPO real authority over infrastructure, extend ISMS-P certification to telecom-network systems and submit a recurrence-prevention plan within three months. In September 2025 the commission opened probes into KT and LG U+ over suspected similar leaks, and its dispute-mediation committee later ruled SKT must pay ₩300,000 in damages to each affected user. The ₩134.8bn fine became the benchmark cited in every later Korean data-security penalty.