It was confirmed that user damage suspected of personal information leaks after connecting to KT's illegal micro base stations (femtocells) began in October last year, not in June this year as initially stated. Attempts at the crimes were carried out across the board beyond the greater Seoul area to Gangwon Province. With KT belatedly grasping the situation and announcing its findings, controversy over poor management and response is expected to grow.
Seo Chang-seok, head of KT's network division, held a briefing on small-sum payment damage on the 17th at KT Gwanghwamun Building West in Jongno District, Seoul, and said, "The number of illegal femtocells has increased from the initially reported four to an additional 16 identified, for a total of 20." He added, "Among the additionally discovered femtocells, there were connection records to illegal femtocells in Dongjak District and Geumcheon District in Seoul, Gwangmyeong and Anyang in Gyeonggi Province, and also in the Gangwon region, although there was no payment damage."
KT said that with 16 femtocells additionally identified, the number of affected customers increased by six to 368, and the damage amount rose by 3.19 million won to 243.19 million won.
Earlier, in the first briefing on Sept. 11, KT said two illegal micro base stations had been found and there were 278 victims. In the second briefing on Sept. 18, it said two more illegal micro base stations had been found, bringing the total to four, with 362 victims. In this announcement, the number of illegal base stations, victims, damage amounts, and connections all increased.
In particular, although KT initially said there had been no customer information leak at the beginning of the incident, it acknowledged in the first briefing that subscriber identity information (IMSI) for 5,561 people had been leaked. In the second briefing, it corrected the number of customers with IMSI leaks to 20,030, and added that as of today the total had risen by 2,197 to 22,227.
Of the 16 additionally discovered femtocells, one was used in the crime. The additional affected customers are one in Dongjak, two in Geumcheon, one in Gwangmyeong, and two in Anyang.
KT initially conducted an investigation into activities in which illegal payment authentication was attempted using the interactive voice response (ARS) method, covering about three months from June this year to Sept. 10. However, prior to this briefing, by widening the investigation period to about 13 months from Aug. 1, 2024, to Sept. 10, 2025, and expanding the payment authentication methods examined beyond ARS to include text messages (SMS) and PASS, the scope of damage expanded.
The leak route for personal information such as name, resident registration number, and gender, which a hacker would need to actually execute small-sum payments, still has not been identified. So far, through illegal femtocells, only indications of leaks of USIM information such as the international mobile subscriber identity (IMSI), the international mobile equipment identity (IMEI), and phone numbers have been confirmed. On this, KT said, "It is correct that (personal information) is not information that can be obtained from illegal base stations," and added, "We understand that the first forensic analysis by the public-private joint investigation team has been completed and the second forensic analysis is underway; confirmation should be possible once the results come out."
Additional damage cannot be ruled out. When asked whether there was no additional damage, KT said, "We would appreciate it if you would consider that we have exhaustively analyzed within the scope the organization can handle," and added, "We worked until early this morning to find even one more victim." On the waiver of early termination fees, it said, "We will review and proceed in consideration of the joint investigation team's results and the customer damage situation."
KT's announcement today matches what lawmakers on the National Assembly's Science. ICT. Broadcasting. and Communications Committee confirmed the previous day, drawing criticism that it was a belated announcement. KT said, "We ask for your understanding that it is difficult to verify the press release from the lawmakers' offices."