KT Corp Fined $40M for Concealing Data Breach Affecting 16,600 Subscribers
South Korea’s Personal Data Protection Commission (PDPC) has imposed a 54 billion won ($40 million) fine on telecom giant KT Corp for failing to disclose a data breach that exposed the personal and payment information of over 16,600 mobile subscribers. The breach, which occurred between 2024 and 2025, enabled hackers to make illegal payments totaling 240 million won ($178,000) using stolen customer data.
During its investigation, the PDPC discovered malicious software on KT’s servers and determined that the company attempted to conceal the intrusion, violating legal requirements for prompt breach reporting. KT has not publicly responded to requests for comment.
The case highlights regulatory scrutiny on data protection in the telecommunications sector, particularly the obligation for swift incident disclosure to mitigate further risks. The fine underscores the consequences of non-compliance with breach notification laws in South Korea.
Source: https://mezha.net/eng/bukvy/cc9744bc_south_korea_fines/
KT Corp Worldwide cybersecurity rating report: https://www.rankiteo.com/company/kt-corp-worldwide
"id": "KT-1785385814",
"linkid": "kt-corp-worldwide",
"type": "Breach",
"date": "1/2024",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': '16,600',
'industry': 'Telecommunications',
'location': 'South Korea',
'name': 'KT Corp',
'type': 'Telecommunications'}],
'attack_vector': 'Malicious software on servers',
'data_breach': {'number_of_records_exposed': '16,600',
'personally_identifiable_information': 'Yes',
'sensitivity_of_data': 'High',
'type_of_data_compromised': ['Personal information',
'Payment information']},
'date_detected': '2024',
'description': 'South Korea’s Personal Data Protection Commission (PDPC) has '
'imposed a 54 billion won ($40 million) fine on telecom giant '
'KT Corp for failing to disclose a data breach that exposed '
'the personal and payment information of over 16,600 mobile '
'subscribers. The breach enabled hackers to make illegal '
'payments totaling 240 million won ($178,000) using stolen '
'customer data. The PDPC discovered malicious software on KT’s '
'servers and determined that the company attempted to conceal '
'the intrusion, violating legal requirements for prompt breach '
'reporting.',
'impact': {'brand_reputation_impact': 'Negative impact due to concealment',
'data_compromised': 'Personal and payment information',
'financial_loss': '54 billion won ($40 million) fine, 240 million '
'won ($178,000) in illegal payments',
'identity_theft_risk': 'High',
'legal_liabilities': 'Regulatory fines and legal actions',
'payment_information_risk': 'High',
'systems_affected': 'KT Corp servers'},
'investigation_status': 'Completed',
'lessons_learned': 'Importance of prompt breach disclosure to mitigate risks '
'and avoid regulatory penalties.',
'motivation': 'Financial gain',
'post_incident_analysis': {'root_causes': 'Malicious software on servers, '
'failure to disclose breach'},
'recommendations': 'Compliance with breach notification laws, transparency in '
'incident reporting, and implementation of robust '
'cybersecurity measures.',
'references': [{'source': 'Personal Data Protection Commission (PDPC)'}],
'regulatory_compliance': {'fines_imposed': '54 billion won ($40 million)',
'regulations_violated': "South Korea's data breach "
'notification laws',
'regulatory_notifications': 'PDPC investigation'},
'response': {'communication_strategy': 'Concealment attempt'},
'title': 'KT Corp Fined $40M for Concealing Data Breach Affecting 16,600 '
'Subscribers',
'type': 'Data Breach'}