Skip to content
KT Faces Prosecution Over Malware Breach and Log Deletion

KT Faces Prosecution Over Malware Breach and Log Deletion

First seen 13 Oct 2026, 23:09 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 14, 2026 at 00:08 UTC
  • •KT's CPO ordered the deletion of logs after a malware breach.
  • •The breach was caused by an SQL injection attack on KT's roaming website.
  • •The Personal Information Protection Commission has filed a complaint against KT for false reporting.

KT, a major South Korean telecommunications company, is facing prosecution after its Chief Privacy Officer ordered the deletion of logs related to a malware breach that occurred in March 2024. The Personal Information Protection Commission (PIPC) found that KT failed to report the breach and neglected to analyze the personal information leak. The malware was installed via an SQL injection attack on KT's roaming website, allowing unauthorized access to employee information. Despite recognizing the breach in March 2024, KT took internal measures without notifying the government and later deleted logs on 10 servers, claiming it was part of routine maintenance. The PIPC has filed a complaint against KT for submitting false materials during the investigation. The investigation concluded with discussions about potential sanctions, including a ban on new subscribers.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2024-03-05
KT recognizes malware breach
KT acknowledged the malware breach but did not report it to authorities, taking internal measures instead.
Biz.Chosun
2024-07-03
KT submits internal analysis report
KT submitted a report indicating no anomalies despite significant unexamined periods on several systems.
Biz.Chosun
2026-10-12
KMCC concludes KT hacking probe
The Korea Media and Communications Commission announced the conclusion of its investigation into KT's security practices.
Biz.Chosun

More articles in this cluster (2)

Following this threat?

Track BPFDoor and Korea Internet & Security Agency in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (11)

1 / 4

Common questions

What was the attack method used?
The attack was executed via an SQL injection vulnerability on KT's roaming website.
What actions did KT take after the breach?
KT took internal measures but did not report the breach to authorities and deleted logs on infected servers.
What are the potential consequences for KT?
KT may face prosecution and sanctions, including a possible ban on new subscribers.