Overview

• The Personal Information Protection Commission issued its largest penalty to date against the carrier for the breach disclosed this year.
• Investigators said intrusions began in 2021 and 2022, culminating in the April 18 exfiltration of 9.82 gigabytes of user data.
• Twenty-five categories of information, including phone numbers and IMSI/USIM identifiers, were exposed for 23.2 million subscribers, with total users affected exceeding 26 million.
• The watchdog faulted unauthenticated servers, outdated operating systems without patches and delayed customer notification, and it ordered governance changes placing a privacy chief over data operations.
• SK Telecom expressed regret, said it will review the ruling and consider legal steps, and highlighted free USIM replacements, a two-month pause on new sign-ups and a compensation and cybersecurity plan exceeding 1 trillion won.