SIM Swapping Risk Prompts Urgent Customer Action
SK Telecom is providing free SIM card replacements to all 25 million of its mobile customers following a recent cyberattack that compromised USIM data. However, the company warns that only 6 million SIM cards will be available for replacement through May 2025 due to supply limitations.
SK Telecom is South Korea’s largest mobile network provider, covering approximately half of the country’s mobile user base.
Malware Attack Exposed Sensitive SIM Data
The breach was identified on April 19, when SK Telecom detected malware operating on its network. This malware enabled threat actors to extract key information stored on users’ SIM cards.
The compromised data includes:
- International Mobile Subscriber Identity (IMSI)
- Mobile Station ISDN Number (MSISDN)
- Authentication keys
- Network usage information
- SMS and contact data stored on SIMs
No personally identifiable information (PII), such as names or financial data, was exposed.
The primary concern is the potential for SIM swapping, a technique where attackers clone a SIM card to hijack a user’s phone number and intercept communications.
Enhanced Protections and Free SIM Replacement Initiative
SK Telecom has stated that its Fraud Detection System (FDS) and SIM Protection Service have been upgraded to detect and block unauthorized SIM changes.
“Currently, SK Telecom holds 1 million SIM cards and plans to secure 5 million more by the end of May 2025,” the company stated in an April 28 update.
Free SIM replacements are being offered to all subscribers registered as of April 18, 2025 (Japan time), including 2 million users with affiliated budget carriers.
Due to limited stock, customers are asked to use the company’s online reservation system at care.tworld.co.kr to schedule their SIM swap in advance.
Roaming Disabled for SIM Protection Users
The company has clarified that subscribers with SIM Protection activated will have international roaming temporarily disabled as a precaution. An upgrade is in progress to allow the feature to work while abroad.
Ongoing Investigation and Customer Communication
SK Telecom is still investigating the scope and root cause of the attack. At this stage, no dark web leaks or secondary damages have been confirmed.
An official FAQ has been published to assist customers, and all affected users will receive personalized security instructions via direct message.
