At 10 a.m. on the 13th, the front of an LG Uplus store in Seongdong District, Seoul, was quiet on the first day of free USIM (subscriber identity module) replacements for customers. As business opened, store employees wiped the windows and swept the floor to prepare for customers. LG Uplus began offering free USIM replacement service to all customers starting that day amid controversy over the exposure of international mobile subscriber identity (IMSI) numbers based on phone numbers.
But it was different from a year ago, when long lines formed in front of stores to replace USIMs after the SK Telecom hacking incident. That day, there was no so-called "open run" for USIM swaps, nor any commotion like arguments with store staff. About 20 minutes after opening, a subscriber visited, and USIM replacement or USIM information updates were available immediately without waiting.
Park Tae-gyu, 75, whom we met at an LG Uplus store, said, "I didn't make a separate reservation, but when I said I wanted to change the USIM, they took care of it," adding, "I changed my phone not long ago, so I didn't replace the physical USIM and only proceeded with an update." A person surnamed Jeong, 58, who visited the same store, also said, "My original reservation date is tomorrow, but I was told I could come today, so I visited."
◇ Preventing a "USIM rush" through lessons from successive carrier hacking incidents… temporary delay in the morning as demand surged for system activations
In the morning, as demand briefly surged for replacements, activation on the "Ucube" IT system was temporarily delayed. However, the company quickly expanded capacity and restored the system. The reason a "USIM rush" did not occur at LG Uplus is that the company is operating a store visit reservation system to prevent the confusion seen during the SK Telecom hacking incident.
LG Uplus subscribers can choose the store, date, and time slot to reduce waiting times. They can also update the USIM online through the Uplugone app (application) and the website. However, phones, watches, and tablets that use old USIMs, USIMs not purchased through a carrier, or eSIMs must visit a store for replacement.
According to LG Uplus, from the 8th through 8 p.m. the previous day, there were 169,873 mobile network operator (MNO) advance reservations and 10,687 mobile virtual network operator (MVNO) reservations, totaling 180,560. As of that day, LG Uplus had secured 2.09 million MNO units and 1.68 million MVNO units.
◇ "Phone number-based IMSI is less secure… we were complacent"
LG Uplus said it is offering the USIM replacement service to restore customer trust amid suspicions of personal information leaks and to strengthen security.
LG Uplus faced criticism after it became known that it had maintained a "phone number-based" IMSI generation system since introducing LTE (fourth-generation mobile communication) in 2011. IMSI is a 15-digit number stored on the USIM. It is the subscriber identifier used when a device first connects to a mobile network. It consists of a country code, a carrier identification code, and a personal identification number, and is key information used to distinguish users on the network.
Until now, LG Uplus had included part of the mobile phone number when generating IMSIs. In the telecom industry, values are typically designed to be random so that, even if an identifier is captured externally, it is difficult to link it to a specific individual. SK Telecom, KT, and overseas providers operate IMSIs as random numbers.
LG Uplus experienced a major personal information leak, including IMSIs, due to a cyberattack in Jan. 2023, but said it did not recognize the IMSI structural issue until June last year. The company said, "After recognizing the IMSI structural issue, it took time to develop the system."
Shin Cheol-won, Head of Team at the Consumer Sovereignty Society, said, "It was clearly the company's fault to maintain a phone number-based IMSI structure," adding, "Not only in the United States and Japan, but domestic competitors also manage IMSIs with random numbers, while LG Uplus remained complacent." Shin added, "We will watch to see whether LG Uplus faithfully fulfills replacement requests from both online and offline customers."
◇ Investigation underway into the disposal of a server related to suspected personal information leaks… "I feel at ease changing the USIM"
Separately from the IMSI structural issue, LG Uplus faces suspicion that it intentionally disposed of a server where a personal information leak occurred.
The Ministry of Science and ICT received a tip about an account leak in July last year and asked the company to conduct a self-inspection. During this process, the company notified that "there were no traces of a breach" and then disposed of one of two servers. LG Uplus is under investigation on suspicion of obstructing a forensic investigation by security authorities. In relation to this, in mid-last month, police raided the LG Uplus Magok headquarters in Gangseo District, Seoul, where the company's integrated control center is located.
Kim Myeong-ja, 70, whom we met at an LG Uplus store in Jung District, Seoul, said, "There was the SK Telecom hacking incident last year, and although the company explains it has nothing to do with security, I felt more at ease changing the USIM, so I stopped by the store and changed it."