Now Hacked
EN
Data breach

Illegal femtocell breach at KT exposes personal data of 16,647 people

First reported · Last reported · 133 related reports

A breach at KT involving illegal miniature base stations known as femtocells exposed the personal information of 16,647 people, while 368 people suffered approximately KRW 240 million in unauthorized mobile micropayment charges. Investigators confirmed access to the internal network using cloned certificates and management failures, and KT announced a program waiving early termination fees and providing compensation. The Personal Information Protection Commission (PIPC) announced an administrative fine of KRW 53.979 billion and a criminal referral over obstruction of its investigation in July 2026, with further inquiries and criminal investigations still ongoing in November.

Key facts

Affected organization
KT
Incident type
Data breach
Occurred / detected
Not confirmed
Scale of damage
Personal information of 16,647 people exposed; 368 people incurred approximately KRW 240 million in unauthorized mobile micropayment charges
Cause / method
Intrusion into the internal network using cloned certificates, and theft of personal information and unauthorized mobile micropayments using illegal femtocells
Location
South Korea

If your data was exposed

Exposed dataPhone number

  1. Don’t tap links in texts, calls or emails that mention this incident and offer compensation, refunds or breach checks. Check directly on the organization’s official website or app.
  2. If you’ve suffered harm, report it. Call 118 (no area code) for privacy violations, contact the police for financial losses, and apply for dispute mediation to seek compensation.Personal Information Infringement Report Center ↗Korean National Police Agency cybercrime report ↗Personal Information Dispute Mediation Committee ↗

Timeline

  1. The Ministry of Science and ICT classified the unauthorized mobile micropayments at KT as a major security incident and confirmed 278 cases of damage.
  2. A comprehensive investigation identified 20 illegal femtocell IDs and connection records for approximately 22,200 people, and determined that illegal connections had occurred since October 2024.
  3. KT apologized for the security incident and announced a program waiving early termination fees and providing compensation.
  4. The Personal Information Protection Commission (PIPC) confirmed 16,647 victims of the data leak and 368 victims of unauthorized mobile micropayments, and announced an administrative fine of KRW 53.979 billion and a criminal referral over obstruction of its investigation.
  5. In connection with the interim findings of the joint public-private investigation team, allegations emerged that malware infections on 43 internal servers had not been reported, and further inquiries and criminal investigations were reported to be ongoing.
  6. KT's third-quarter operating profit fell 6.1%, partly due to compensation costs related to the security incident.

133 related reports

  • Data breachKT

    KT internet installer leaks customer data; complaint closed

    Impact: Customer personal information

    A KT internet installation technician leaked customers' personal information. Even after receiving a report, KT closed the complaint by blaming voice phishing without verifying the facts.

    Related reports: 2 · last report →
  • MalwareKT

    KT confirmed to have had malware-infected servers and failed to report incident

    Impact: 43 servers confirmed infected with malware

    Between March and July 2024, KT discovered 43 servers infected with malware including BPFDoor and handled them on its own without reporting. In a company-wide server inspection in September 2025, it found traces of intrusion and suspicious signs and reported them to the Korea Internet & Security Agency. A government investigation revealed the malware infections and the failure to report; KT apologized and announced plans to build an integrated monitoring system. Controversy continued afterward over log deletion and the submission of materials.

    Related reports: 25 · last report →
  • MalwareKT

    KT accused of spreading malware to PCs of web hard drive users

    Impact: Estimated several hundred thousand web hard drive customers affected

    KT came under police investigation over allegations that in 2020 it spread malware to the PCs of customers using web hard drive services. The number of victims was estimated at several hundred thousand, and police investigated it as an organized act with separate roles for development, distribution and interception. KT claimed it was a network management response to control malicious grid services and that only a small number of people were involved.

    Related reports: 3 · last report →

The summary and key facts are written by AI from related reports and may contain errors. Check the original articles and the organization’s official statements for accurate details.