Now Hacked
EN
Malware

KT confirmed to have had malware-infected servers and failed to report incident

First reported · Last reported · 25 related reports

Between March and July 2024, KT discovered 43 servers infected with malware including BPFDoor and handled them on its own without reporting. In a company-wide server inspection in September 2025, it found traces of intrusion and suspicious signs and reported them to the Korea Internet & Security Agency. A government investigation revealed the malware infections and the failure to report; KT apologized and announced plans to build an integrated monitoring system. Controversy continued afterward over log deletion and the submission of materials.

Key facts

Affected organization
KT
Incident type
Malware
Occurred / detected
Not confirmed
Scale of damage
43 servers confirmed infected with malware
Cause / method
Infection with malware including BPFDoor and Smominru and intrusion into servers
Location
South Korea

Timeline

  1. It was reported that KT found 4 traces of intrusion and 2 suspicious cases in a company-wide server inspection and reported them to the Korea Internet & Security Agency.
  2. A joint public-private investigation revealed that KT had found 43 infected servers in 2024 without reporting them, and KT apologized.
  3. It was reported that 103 types of malware including BPFDoor had infected systems in the KT breach.
  4. Controversy arose over the government investigation's findings on whether information leaks from the server hack had been confirmed.
  5. Calls for additional sanctions were raised on the grounds of log deletion and the submission of false materials in the hacking incident.

25 related reports

  • Data breachKT

    KT internet installer leaks customer data; complaint closed

    Impact: Customer personal information

    A KT internet installation technician leaked customers' personal information. Even after receiving a report, KT closed the complaint by blaming voice phishing without verifying the facts.

    Related reports: 2 · last report →
  • Data breachKT

    Illegal femtocell breach at KT exposes personal data of 16,647 people

    16.6KImpact: Personal information of 16,647 people exposed; 368 people incurred approximately KRW 240 million in unauthorized mobile micropayment charges

    A breach at KT involving illegal miniature base stations known as femtocells exposed the personal information of 16,647 people, while 368 people suffered approximately KRW 240 million in unauthorized mobile micropayment charges. Investigators confirmed access to the internal network using cloned certificates and management failures, and KT announced a program waiving early termination fees and providing compensation. The Personal Information Protection Commission (PIPC) announced an administrative fine of KRW 53.979 billion and a criminal referral over obstruction of its investigation in July 2026, with further inquiries and criminal investigations still ongoing in November.

    Related reports: 133 · last report →
  • MalwareKT

    KT accused of spreading malware to PCs of web hard drive users

    Impact: Estimated several hundred thousand web hard drive customers affected

    KT came under police investigation over allegations that in 2020 it spread malware to the PCs of customers using web hard drive services. The number of victims was estimated at several hundred thousand, and police investigated it as an organized act with separate roles for development, distribution and interception. KT claimed it was a network management response to control malicious grid services and that only a small number of people were involved.

    Related reports: 3 · last report →

The summary and key facts are written by AI from related reports and may contain errors. Check the original articles and the organization’s official statements for accurate details.