South Korea prosecutes KT as CPO orders log deletions after malware breach

"It's the first time I've seen someone in a position that must be responsible from start to finish for all personal information at that company order the deletion of logs (user access records)."

Lee Jeong-ryeol, vice chair of the Personal Information Protection Commission, said this at the 15th plenary meeting held on Jul. 29, noting the chief privacy officer (CPO) at KT at the time in 2025. According to the vice chair, the CPO ordered the deletion of logs on 38 servers infected with malware, and some employees followed the order, leading to the deletion of logs on 10 servers.

According to the transcript of the commission's 15th plenary meeting on the 14th, it contained detailed questions and answers over the circumstances surrounding KT's order to delete logs and the submission of materials. In the transcript released at the end of Sep., the Personal Information Protection Commission pointed out that KT neglected to analyze the personal information leak during the hacking incident, did not report it to the authorities, and later deleted some logs. It voted to file a complaint over acts of submitting false materials during the investigation and recanting statements. KT argued that the log deletion occurred during system maintenance and was not intended to obstruct or conceal the investigation.

◇ KT: "no signs of a leak"… unexamined periods existed on 10 of 13 systems

According to the Personal Information Protection Commission's investigation, the attacker infiltrated by exploiting an "SQL injection" vulnerability in the reservation input field on KT's roaming website in Mar. 2024. It is an attack method that accesses databases by inserting malicious commands into the input field. The attacker viewed employee information from the roaming rental server's administrator page and then installed malware on multiple servers.

The Personal Information Protection Commission reported that KT first recognized the breach on Mar. 5, 2024, but took internal measures without reporting it to the government. KT said it completed related measures in Aug. of the same year after blocking the spread of the malware and checking for any remnants.

However, according to the Personal Information Protection Commission, even after confirming the SQL injection attack on the roaming server where the initial attack occurred, KT did not prepare an analysis report on that attack. The internal analysis reports for other servers also lacked detailed content such as facts, attack analysis, and system and web log analysis.

The vice chair cited a detection and response analysis status document submitted by KT dated Jul. 3, 2024, and pointed out that there were significant unexamined periods on 10 of 13 personal information processing systems. Despite not sufficiently analyzing the periods when malware was installed, the internal reports concluded "no anomalies" and "no signs of a leak."

During the subsequent government investigation, it was confirmed that the names, phone numbers, and account information of 23 KT employees and partner company workers were leaked. However, it could not confirm whether additional personal information of users processed on the infected servers had been leaked. The Personal Information Protection Commission said KT did not thoroughly collect and preserve evidence at the time of the incident, and by the time of the investigation, the retention period for the then network logs had passed, limiting the ability to confirm the facts.

◇ Logs deleted ahead of an external security check… KT: "system maintenance work"

The log deletion occurred as KT prepared for an external security check the following year. KT said it pursued an external check in Apr. 2025 following a competitor's personal information leak and conducted "cleansing" on some servers from June to August of the same year.

KT explained that the cleansing was system maintenance that included not only log deletion but also operating system reinstalls and malware response. It determined there was no need to reexamine a past incident that had already been addressed, and emphasized that the work took place before the Personal Information Protection Commission's investigation.

Commissioner Kim Hwi-gang asked why logs were ordered deleted even though the servers were not short on disk space. KT said it did not know the exact intent of the person who gave the order at the time, but understood that there was a burden in being re-investigated and having to explain an incident already recognized and addressed during an external security check.

The current CPO who attended the meeting said the company takes the log deletion issue seriously and will build a system to centrally collect and store logs from all servers to prevent a recurrence.

Jang Hang-bae, a professor of industrial security at Chung-Ang University, said, "A chief privacy officer must also preserve evidence so that the possibility of a leak and the scope of damage can be verified after an incident," and added, "Even if the malware has been removed, it cannot be considered that verification of a leak is complete, so if logs were deleted for system maintenance, the circumstances and basis for that decision should be examined."

◇ KT recanted statements after saying "no materials"… belatedly submitted backup logs

The circumstances of submitting materials were also at issue. The Personal Information Protection Commission reported that KT initially said in the investigation that it had deleted malware-related evidence and was not keeping it, but when digital forensics confirmed indications that log files had been deleted, KT recanted and submitted separately stored materials.

KT explained that at first it believed all materials had been deleted, but during the investigation it belatedly identified an external professional firm's security check report and learned of the existence of backup logs. It said that after finding those materials, it notified the joint public-private investigation team and the Personal Information Protection Commission.

In response, the commission's investigator pointed out that the time when KT received the external security check results was not long after the investigation had progressed, but in Sep. 2025, when the investigation began. The investigator also said that the facts related to the cleansing were confirmed on Jan. 30 of this year, after the joint public-private investigation ended on Dec. 29 of last year. Citing this investigation timeline, the investigator argued it was necessary to correct the timing and circumstances of the material confirmation and submission as explained by KT.

The Personal Information Protection Commission determined that KT refused to submit materials or submitted false materials to conceal or downplay legal violations, constituting a violation of the Personal Information Protection Act.

KT argued that no external leak of customer information was confirmed in this malware infection incident and that it submitted all backup logs during the investigation. A Korea Internet & Security Agency (KISA) official who attended the meeting, while noting it was an assumption, raised the possibility that the deletion of multiple logs may have cost investigators the chance to determine the exact scale of harm to data subjects.

On Jul. 29, at the 15th plenary meeting, the Personal Information Protection Commission voted to file a complaint over acts obstructing the investigation related to KT's malware infection incident and decided to suspend the investigation into the case. However, it said it would resume the investigation and determine whether to take action if additional facts or evidence are found through the results of the criminal investigation.

A KT official said, "We will fully cooperate with the relevant investigation and strengthen personal information protection going forward."