South Korea’s Personal Information Protection Commission fined KT Corporation KRW 53.979 billion, roughly $39 million, over data protection violations tied to an internal network compromise that persisted for nearly 11 months. The breach began with a lost cellular femtocell whose valid authentication certificate let attackers pose as part of KT’s network and collect subscriber data, and the regulator separately found the telecom giant had known about a related malware infection for more than a year without reporting it.
KT’s 11-Month Compromise via a Lost Femtocell and a Decade-Valid Certificate
The point of breach was a lost KT cellular femtocell containing a valid authentication certificate. The attackers installed that certificate on a self-made device that appeared as a legitimate part of KT’s network, capturing cellular traffic from nearby devices, including mobile phone numbers, IMSI, and IMEI, and later SMS and ARS authentication codes used for mobile micro-payments. PIPC alleged inadequate controls, noting that femtocell certificates remained valid for 10 years, connections were not restricted by source IP addresses, and a route existed that bypassed the femtocell management server, allowing the attackers to stay connected and collect data from October 2024 to September 2025 without detection.
BPFDoor Infections on 38 KT Servers and the Destroyed Logs
During the investigation, PIPC discovered that 38 KT IT service network servers had been compromised by malware, including BPFDoor, as early as March 2024. BPFDoor is a stealthy Linux and Solaris backdoor that uses Berkeley Packet Filter technology to activate via “magic” packets without opening listening ports, and PwC has linked its use to the China-nexus Red Menshen espionage group targeting telecommunications providers. PIPC alleges that KT knew about the infection since then but failed to report it, handled it internally with no transparency toward customers, and later deleted logs from some compromised servers during malware inspection, following the same evidence-wiping pattern as LG U+, which reinstalled operating systems and disposed of servers.
The Subscriber Toll: 16,647 Exposed and 368 Fraud Victims
PIPC launched its investigation after user reports of fraudulent micropayments, and a day later KT filed its initial breach notification reporting roughly 5,500 customers exposed. The investigation ultimately determined that the incident exposed the personal information of 16,647 subscribers and caused fraudulent mobile payments of KRW 240 million, about $167,400, for at least 368 of them. Because KT wiped those historical network logs, the Commission said it could not determine whether additional customer data was stolen.
Regulatory Response: The Fine and a New Legislative Push
PIPC ordered KT to strengthen security controls for femtocells and other telecommunications equipment, reinforce governance over personal information protection, ensure its chief privacy officer plays a substantive oversight role, and expand ISMS-P certification to cover its mobile network systems. The regulator also announced plans for legislative changes introducing stronger penalties for companies that conceal or destroy evidence before or during investigations, a direct response to the log deletion it documented at both KT and LG U+.
What the Evidence Wiping Means for Understanding the Full Breach Scope
KT is South Korea’s largest telecommunications operator, serving 13.5 million mobile subscribers, about 90 percent of fixed-line subscribers, and 45 percent of high-speed internet users. An undetected 11-month compromise at a carrier of that scale exposes identifiers that enable identity theft and mobile payment fraud, since IMSI and IMEI values combined with SMS and ARS authentication codes give an attacker the raw material for account takeover.
The regulator’s finding that it cannot determine the full scope of data theft because KT destroyed historical network logs is the central unresolved question of the case. The decision to pursue legislative penalties for evidence destruction signals that regulators now treat log preservation during investigations as a core compliance obligation, not an optional courtesy. For the telecommunications industry, the case highlights a neglected physical attack surface: femtocells and similar edge equipment that carry long-lived certificates are effectively trusted devices inside the network, and a 10-year certificate validity window is far too long for hardware that can be lost, stolen, or resold. Carriers that do not revoke and rotate equipment credentials quickly after loss are leaving the same door open that the KT attackers walked through.
The case also raises a question about the balance between the fine and the outcome for customers. The KRW 53.979 billion penalty, alongside corrective orders that require KT to expand ISMS-P certification to its mobile network systems and give its chief privacy officer a substantive oversight role, is intended to force structural change at the carrier. Whether those changes prevent a repeat of an 11-month undetected intrusion will depend on whether the company treats the certificate-management controls as a compliance checkbox or as an operational security requirement, a distinction regulators have increasingly pressed on in the aftermath of incidents where equipment security was treated as an afterthought.
