Wireless carrier KT fined $37.4 million over data leak via illegal base stations

Seoul, July 30 (IANS) South Korea’s privacy watchdog said on Thursday it has fined wireless carrier KT Corp. 53.9 billion won ($37.4 million) over a major data breach that affected more than 16,000 users.

The Personal Information Protection Commission also ordered KT to take corrective measures over the breach into the company’s wireless network through unauthorised mobile base stations.

The breach, first reported by the company in September, affected phone numbers and mobile device identification numbers of 16,647 users, according to the regulator, reports Yonhap news agency.

Malicious actors then used the information to carry out unauthorised transactions, leading to losses of 240 million won in total for 368 victims.

The watchdog said the hackers went unnoticed while they accessed KT’s wireless network between Oct. 8. 2024, and Sept. 5, 2025, adding the company only realised the breach had occurred after a user complaint.

It ordered the company to strengthen security measures for its wireless network equipment and its personal information protection measures.

Meanwhile, KT Corp.’s chief had acknowledged that the company had poorly managed micro base stations linked to recent unauthorised mobile payment breaches.

“After the incident, we reviewed the management of femtocells and found numerous vulnerabilities and poor management,” Kim Young-shub, chief executive officer (CEO) of KT, said during a parliamentary hearing. “We have since taken measures to prevent illegal femtocells from connecting to the network.”

A femtocell is a small, low-power cellular base station, typically designed for use in homes or small businesses. Kim said KT outsources their installation and management.

According to the company, unregistered femtocells were connected to its network around late August and gained access to private data of 362 users, with damages estimated at 240 million won ($173,000).

Kim also said KT is expanding its analysis to all authentication data, after lawmakers pointed out that the company’s probe had focused only on breaches involving the automated response system (ARS).

—IANS

na/