Seoul: The data protection regulator on Thursday penalized major wireless carrier SK Telecom Co. a record 134.8 billion won (US$96.9 million) over a massive data breach that affected its entire 23 million user base. It marks the highest-ever penalty the Personal Information Protection Commission (PIPC) has imposed since its launch in 2020, surpassing a 69.2 billion-won fine against Google in 2022.
According to Yonhap News Agency, in April, SK Telecom belatedly disclosed a major leak of universal subscriber identity module (USIM) data from its servers, prompting the company to offer free USIM replacements to all of its users and an investigation by the regulator. "Data of a very critical nature was leaked, and the majority of the commission's members recognized the problem that the company did not manage things properly," Ko Hak-soo, the PIPC's chairperson, said in a briefing.
SK Telecom expressed regret over the PIPC's decision, pledging to strengthen its customer information protection measures. According to the PIPC's investigation, 25 types of data of 23.2 million subscribers to the company's LTE and 5G networks, including phone numbers and international mobile subscriber identity, were leaked due to a cyberattack.
The investigation found that hackers first infiltrated the company's internal network to install malware in August 2021 and again in June 2022 before taking 9.82 gigabytes of personal user data on April 18 this year. The regulator determined that the leak took place as the carrier did not take basic security measures and poorly managed its internal servers.
For instance, the company did not carry out inspections after it discovered that hackers had accessed its home subscriber server storing user information in February 2022, according to the PIPC. The personal information stored on the server could also be accessed without any authentication procedures.
In May, Ko said the regulator had detected signs the data had been leaked through Singapore. Regarding those comments, the chairperson said other authorities were looking into the issue. "(We) need to check where it went after going through Singapore," Ko said. "Our commission is not directly involved there, but I understand that investigative authorities are conducting follow-up investigations into the matter."
The PIPC also said the company did not carry out basic security updates, exposing itself to cyberattacks. The company installed an operating system with security vulnerabilities in November 2016 but did not conduct security updates even until the data leak this April.
Along with the penalty, the PIPC ordered the carrier to strengthen its security measures and make changes to its governance structure so that the chief privacy executive oversees the company's entire personal information operations. In order to prevent similar cases, the PIPC plans to announce measures to strengthen personal information protection next month.