KT Corp Fined ₩53.97 Billion for Femtocell Breach and Evidence Tampering

KT Corp was fined ₩53.97 billion (approximately $37.6 million) by South Korea's privacy regulator for failing to secure its femtocell system, allowing unauthorized access to its mobile network. The breach began in August 2024 when attackers exploited a lost femtocell, using a shared plaintext authentication certificate to connect counterfeit devices. This led to unauthorized mobile payments affecting 368 users, resulting in financial losses of 240 million won. The Personal Information Protection Commission (PIPC) found that KT deleted access logs from ten infected servers during the investigation, indicating an attempt to conceal the breach. Both KT and LG Uplus are referred for criminal investigation, marking a significant escalation in regulatory enforcement. KT has committed to rebuilding its security systems and compensating affected customers.

Key Points: • KT Corp fined ₩53.97 billion for inadequate femtocell security and evidence tampering. • Attackers exploited a lost femtocell to gain unauthorized access to KT's network. • 368 users experienced financial losses due to unauthorized mobile payments linked to the breach.