KT fined 54 billion won for massive data leak, faces criminal charges

South Korea's data protection watchdog has slapped KT Corp. with a hefty 54 billion won ($40 million) fine following a large-scale personal information leak. The company also faces criminal charges for obstructing the investigation by submitting false data and destroying evidence.

The Personal Information Protection Commission announced the penalties on May 30, citing violations of the personal information protection law. Investigations revealed that hackers had compromised KT's mini-base stations, extracting certificates to operate illegal stations. These stations then intercepted user data, including phone numbers and device identifiers, and combined it with personal information to request unauthorized mobile payments. This resulted in approximately 240 million won ($180,000) in losses for 368 users.

Investigators found KT negligent in managing basic controls for internal network access since introducing mini-base stations in 2016. The company set a 10-year validity period for mini-base station certificates and did not restrict access IP addresses, allowing connections from abroad or other carriers. Furthermore, KT lacked a system to detect and block unauthorized access to its core network.

KT has expressed remorse, stating, "We take the Personal Information Protection Commission's decision seriously and deeply apologize once again for causing great concern and anxiety to our customers and the public." The company vowed to "reorganize the entire personal information protection system from scratch, expand security investments, and do our best to prevent recurrence and regain customer trust."

Separately, the commission is referring LG Uplus to prosecutors for allegedly destroying evidence by disposing of servers before an investigation into a separate data leak suspicion began.

“

We take the Personal Information Protection Commission's decision seriously and deeply apologize once again for causing great concern and anxiety to our customers and the public. We will reorganize the entire personal information protection system from scratch, expand security investments, and do our best to prevent recurrence and regain customer trust.