SK Telecom Fined $97 Million for Data Breach Affecting Half of South Korea's Population.

SK Telecom, South Korea's largest mobile operator, has been fined $97 million for a cyberattack that compromised the data of about half of the nation's population. The Personal Information Protection Commission found that the company failed to protect customer data and not report breaches in a timely manner. SK Telecom has expressed regret and committed to strengthening customer data protection. Lawmaker Yu Yong Weon raised concerns about the national security implications of the hack, citing potential access to sensitive government communications.

SK Telecom, South Korea's largest mobile operator, has been fined $97 million by the Personal Information Protection Commission (PIPC) for a cyberattack that compromised the data of about half of the nation's population. The PIPC found that SK Telecom failed to protect customer data and did not report the breaches in a timely manner [1].

The breach, which was disclosed in April, affected 23 million users, including those on the company's LTE and 5G networks. The PIPC investigation revealed that hackers gained access to the company's internal network in August 2021 and again in June 2022 before stealing 9.82 gigabytes of personal user data on April 18, 2025 [1].

The PIPC determined that SK Telecom did not take basic security measures and poorly managed its internal servers. For instance, the company did not conduct inspections after discovering hacker access to its servers in February 2022 and did not carry out basic security updates, exposing itself to cyberattacks [1].

SK Telecom has expressed regret and committed to strengthening customer data protection. The company has been ordered to strengthen its security measures and make changes to its governance structure so that the chief privacy executive oversees the entire personal information operations [1].

Lawmaker Yu Yong Weon has raised concerns about the national security implications of the hack. He suggested that the hackers could potentially reconstruct entire call logs, exposing sensitive communications at the highest level of the government [2].

The newly proposed National Cybersecurity Act aims to unify the government’s emergency response to cyberattacks and facilitate intelligence sharing on cybersecurity threats [2].

References:
[1] https://en.yna.co.kr/view/AEN20250828005000315
[2] https://www.bloomberg.com/news/articles/2025-08-28/sk-telecom-fined-97-million-for-breach-of-personal-data