KT accused of spreading malware to PCs of web hard drive users
KT came under police investigation over allegations that in 2020 it spread malware to the PCs of customers using web hard drive services. The number of victims was estimated at several hundred thousand, and police investigated it as an organized act with separate roles for development, distribution and interception. KT claimed it was a network management response to control malicious grid services and that only a small number of people were involved.
Key facts
- Affected organization
- KT
- Incident type
- Malware
- Occurred / detected
- Not confirmed
- Scale of damage
- Estimated several hundred thousand web hard drive customers affected
- Cause / method
- Allegations that KT distributed malware to customer PCs and intercepted network communications
- Location
- South Korea
Timeline
- Allegations that KT spread malware to the PCs of web hard drive customers, with an estimated several hundred thousand victims, came to light.
- It emerged that police were investigating it as an organized act with separate roles for development, distribution and interception, while KT claimed it was a network management response.
- Questions were raised about the Ministry of Science and ICT's lack of response in connection with the four-year investigation.
3 related reports
Other incidents at KT
KT internet installer leaks customer data; complaint closed
Impact: Customer personal information
A KT internet installation technician leaked customers' personal information. Even after receiving a report, KT closed the complaint by blaming voice phishing without verifying the facts.
Related reports: 2 · last report →Illegal femtocell breach at KT exposes personal data of 16,647 people
16.6KImpact: Personal information of 16,647 people exposed; 368 people incurred approximately KRW 240 million in unauthorized mobile micropayment charges
A breach at KT involving illegal miniature base stations known as femtocells exposed the personal information of 16,647 people, while 368 people suffered approximately KRW 240 million in unauthorized mobile micropayment charges. Investigators confirmed access to the internal network using cloned certificates and management failures, and KT announced a program waiving early termination fees and providing compensation. The Personal Information Protection Commission (PIPC) announced an administrative fine of KRW 53.979 billion and a criminal referral over obstruction of its investigation in July 2026, with further inquiries and criminal investigations still ongoing in November.
Related reports: 133 · last report →KT confirmed to have had malware-infected servers and failed to report incident
Impact: 43 servers confirmed infected with malware
Between March and July 2024, KT discovered 43 servers infected with malware including BPFDoor and handled them on its own without reporting. In a company-wide server inspection in September 2025, it found traces of intrusion and suspicious signs and reported them to the Korea Internet & Security Agency. A government investigation revealed the malware infections and the failure to report; KT apologized and announced plans to build an integrated monitoring system. Controversy continued afterward over log deletion and the submission of materials.
Related reports: 25 · last report →
The summary and key facts are written by AI from related reports and may contain errors. Check the original articles and the organization’s official statements for accurate details.