SK Telecom walloped with $97M fine after schoolkid security blunders let attackers run riot
(2025/08/28)
- Reference: 1756392809
- News link: https://www.theregister.co.uk/2025/08/28/sk_telecom_regulator_fine/
- Source link:
South Korea's privacy watchdog has slapped SK Telecom with a record ₩134.5 billion ($97 million) fine after finding that the mobile giant left its network wide open to hackers through a catalog of bungles.
The case stems from a breach disclosed in April, when [1]SK Telecom admitted that hackers had swiped the universal subscriber identity module (USIM) data of almost 27 million subscribers. To put that in context, the population of the entire country is a shade over 50 million. The carrier tried to mitigate the fallout by offering free SIM replacements to affected customers, but regulators smelled something bigger and launched a full-blown probe into the leak.
The Personal Information Protection Commission (PIPC) [2]said that the country's biggest carrier "did not even implement basic access controls" between its internet-facing systems and internal management network. As a result, attackers were able to infiltrate SKT's core systems, extract authentication data, and siphon off subscriber information at scale.
[3]
The privacy watchdog estimates that the damage was slightly less than SK Telecom initially claimed, with approximately 23 million subscribers affected by the breach – a mere 45 percent of the country's population.
[4]
[5]
According to the regulator's report, SKT failed at almost every layer of defense. The company allegedly didn't check logs from intrusion detection systems so it ignored anomalous behavior while attackers quietly mapped out the operator's infrastructure. In one particularly damning finding, the PIPC report said administrators had dumped thousands of server credentials in plaintext on a management network server. Around 4,899 usernames and passwords for 2,365 servers were just sitting there, without so much as a password protecting access to Home Subscriber Server (HSS) databases, the regulator claimed.
It doesn't take much imagination to guess what happened next. Armed with the harvested account details, intruders appear to have hopped into the management servers, installed malware, and queried the HSS database directly. From there, they were able to view and extract subscriber information without so much as a raised eyebrow from SKT's monitoring teams.
[6]
The regulator also flagged failures around cryptography. It found that more than 26 million USIM authentication keys – the "Ki" values used to verify subscribers and provision mobile services – were left unencrypted in SKT's databases. That blunder would have handed attackers the means to replicate SIM credentials, raising the specter of large-scale identity fraud or cloned devices piggybacking on legitimate accounts.
[7]If you thought China's Salt Typhoon was booted off critical networks, think again
[8]Senator to Google: Give us info from telco Salt Typhoon probes
[9]FCC to telcos: By law you must secure your networks from foreign spies. Get on it
[10]Charter, Consolidated, Windstream reportedly join China's Salt Typhoon victim list
"The security operating environment between the internet and the internal network was managed and operated in a state that was very vulnerable to illegal intrusion," the PIPC scolded in its decision.
In addition to the eye-watering fine, SKT has been ordered to implement a raft of remedial measures, including proper encryption, tighter access controls, and real-time monitoring of its intrusion detection systems. The PIPC said the size of the penalty reflected both the seriousness of the failings and the scale of personal information put at risk.
SK Telecom did not immediately respond to The Register 's questions.
The PIPC's verdict is a reminder that telecom companies are high-value espionage and cybercrime targets, and regulators are losing patience when operators cut corners on basics. It also aligns with international warnings. Just yesterday, The Register reported that Salt Typhoon, the Chinese state-sponsored crew that has been infiltrating global telecoms routers since at least 2019, [11]continues to wreak havoc inside company networks.
[12]
The difference here is that SKT didn't need a nation-state APT to get burned. According to South Korea's regulator, sloppy practices were enough to let intruders come in and walk off with subscriber data. ®
Get our [13]Tech Resources
[1] https://www.theregister.com/2025/04/28/asia_tech_news_in_brief/
[2] https://www.pipc.go.kr/np/cop/bbs/selectBoardArticle.do?bbsId=BS074&mCode=C020010000&nttId=11453
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aLB9GdyrcYQB0dTHxTf1ngAAAIc&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aLB9GdyrcYQB0dTHxTf1ngAAAIc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aLB9GdyrcYQB0dTHxTf1ngAAAIc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aLB9GdyrcYQB0dTHxTf1ngAAAIc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://www.theregister.com/2025/08/28/china_salt_typhoon_alert/
[8] https://www.theregister.com/2025/07/25/senator_mandiant_salt_typhoon_demands/
[9] https://www.theregister.com/2025/01/17/fcc_telcos_calea/
[10] https://www.theregister.com/2025/01/06/charter_consolidated_windstream_salt_typhoon/
[11] https://www.theregister.com/2025/08/28/china_salt_typhoon_alert/
[12] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aLB9GdyrcYQB0dTHxTf1ngAAAIc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[13] https://whitepapers.theregister.com/
The case stems from a breach disclosed in April, when [1]SK Telecom admitted that hackers had swiped the universal subscriber identity module (USIM) data of almost 27 million subscribers. To put that in context, the population of the entire country is a shade over 50 million. The carrier tried to mitigate the fallout by offering free SIM replacements to affected customers, but regulators smelled something bigger and launched a full-blown probe into the leak.
The Personal Information Protection Commission (PIPC) [2]said that the country's biggest carrier "did not even implement basic access controls" between its internet-facing systems and internal management network. As a result, attackers were able to infiltrate SKT's core systems, extract authentication data, and siphon off subscriber information at scale.
[3]
The privacy watchdog estimates that the damage was slightly less than SK Telecom initially claimed, with approximately 23 million subscribers affected by the breach – a mere 45 percent of the country's population.
[4]
[5]
According to the regulator's report, SKT failed at almost every layer of defense. The company allegedly didn't check logs from intrusion detection systems so it ignored anomalous behavior while attackers quietly mapped out the operator's infrastructure. In one particularly damning finding, the PIPC report said administrators had dumped thousands of server credentials in plaintext on a management network server. Around 4,899 usernames and passwords for 2,365 servers were just sitting there, without so much as a password protecting access to Home Subscriber Server (HSS) databases, the regulator claimed.
It doesn't take much imagination to guess what happened next. Armed with the harvested account details, intruders appear to have hopped into the management servers, installed malware, and queried the HSS database directly. From there, they were able to view and extract subscriber information without so much as a raised eyebrow from SKT's monitoring teams.
[6]
The regulator also flagged failures around cryptography. It found that more than 26 million USIM authentication keys – the "Ki" values used to verify subscribers and provision mobile services – were left unencrypted in SKT's databases. That blunder would have handed attackers the means to replicate SIM credentials, raising the specter of large-scale identity fraud or cloned devices piggybacking on legitimate accounts.
[7]If you thought China's Salt Typhoon was booted off critical networks, think again
[8]Senator to Google: Give us info from telco Salt Typhoon probes
[9]FCC to telcos: By law you must secure your networks from foreign spies. Get on it
[10]Charter, Consolidated, Windstream reportedly join China's Salt Typhoon victim list
"The security operating environment between the internet and the internal network was managed and operated in a state that was very vulnerable to illegal intrusion," the PIPC scolded in its decision.
In addition to the eye-watering fine, SKT has been ordered to implement a raft of remedial measures, including proper encryption, tighter access controls, and real-time monitoring of its intrusion detection systems. The PIPC said the size of the penalty reflected both the seriousness of the failings and the scale of personal information put at risk.
SK Telecom did not immediately respond to The Register 's questions.
The PIPC's verdict is a reminder that telecom companies are high-value espionage and cybercrime targets, and regulators are losing patience when operators cut corners on basics. It also aligns with international warnings. Just yesterday, The Register reported that Salt Typhoon, the Chinese state-sponsored crew that has been infiltrating global telecoms routers since at least 2019, [11]continues to wreak havoc inside company networks.
[12]
The difference here is that SKT didn't need a nation-state APT to get burned. According to South Korea's regulator, sloppy practices were enough to let intruders come in and walk off with subscriber data. ®
Get our [13]Tech Resources
[1] https://www.theregister.com/2025/04/28/asia_tech_news_in_brief/
[2] https://www.pipc.go.kr/np/cop/bbs/selectBoardArticle.do?bbsId=BS074&mCode=C020010000&nttId=11453
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aLB9GdyrcYQB0dTHxTf1ngAAAIc&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aLB9GdyrcYQB0dTHxTf1ngAAAIc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aLB9GdyrcYQB0dTHxTf1ngAAAIc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aLB9GdyrcYQB0dTHxTf1ngAAAIc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://www.theregister.com/2025/08/28/china_salt_typhoon_alert/
[8] https://www.theregister.com/2025/07/25/senator_mandiant_salt_typhoon_demands/
[9] https://www.theregister.com/2025/01/17/fcc_telcos_calea/
[10] https://www.theregister.com/2025/01/06/charter_consolidated_windstream_salt_typhoon/
[11] https://www.theregister.com/2025/08/28/china_salt_typhoon_alert/
[12] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aLB9GdyrcYQB0dTHxTf1ngAAAIc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[13] https://whitepapers.theregister.com/
Re: Did anyone get fired?
Andy Non
They probably cleaned up... by firing the office janitor.
Re: Did anyone get fired?
Anonymous Coward
... a record ₩134.5 billion ($97 million) fine ...
A slap on the wrist, a pittance. ie: nothing but a bad joke.
27M subscribers?
In a country with a population of ~ 50M?
If my math is correct, over 50% of the population was affected.
The fine ends up being $3.59 / subscriber.
Ridiculous.
The CEO and the whole board of directors are still laughing.
The fine should have been no less than $100* per subscriber and the company put under administration until the sum is paid in full.
With interests and from the end of year dividends.
... must have been fired.
Not only fired: prosecuted for a criminal offence.
.
* I am assuming the author means US currency.
Did anyone get fired?
Given the criminal negligence, someone must have been fired.