KT, which suffered a personal information leak last year caused by the abuse of femtocells (small base stations), was hit with a penalty surcharge of 53.979 billion won by the Personal Information Protection Commission. The Personal Information Protection Commission previously imposed a 134.8 billion won penalty surcharge last year on SK Telecom for a personal information leak and, this year, a record 624.681 billion won on Coupang.
The Personal Information Protection Commission imposed a 134.8 billion won penalty surcharge—about 1% of the prior year's wireless service revenue—on SK Telecom last year after SIM data hacking leaked the personal information of about 23.24 million people. Although the details of the leaks differ, applying the same standard to KT would put the penalty surcharge at about 60 billion to 70 billion won, meaning the actual amount levied came in lower. However, looking only at the penalty surcharge per person leaked, the severity of KT's sanction is about 3.24 million won per person, far higher than SK Telecom (5,800 won) or Coupang (16,600 won).
KT detected the possibility of a personal information leak in Sep. last year and reported it. Through femtocells, personal information including the mobile phone numbers, subscriber identity numbers (IMSI), and device identity numbers (IMEI) of 16,647 people was leaked. Femtocells are ultra-small base stations that provide communications within a 10-meter radius. The Personal Information Protection Commission viewed this case as different from past personal information leaks in that there was actual unauthorized micro-payment damage totaling 240 million won for 368 of those whose data was leaked. Along with imposing a penalty surcharge, the Personal Information Protection Commission decided to file a complaint over KT's failure to properly analyze personal information leakage and to report to the government at the time of a malware infection incident in Mar. 2024, its subsequent deletion of some logs from the incident server, and its obstruction of the Commission's investigation by submitting false materials and reversing statements during the probe.
◇ KT penalty surcharge 3.2 million won per person for data leak, SKT 5,800 won, Coupang 16,600 won
The Personal Information Protection Commission can impose a penalty surcharge of up to 3% of the revenue related to the violation. KT's wireless service revenue is around 7 trillion won. A simple application of the statutory ceiling would put the penalty surcharge at around 200 billion won. However, the Personal Information Protection Commission determines the level of sanctions by focusing on the severity of the violation and related revenue rather than the simple number of people affected.
In terms of the scale of the personal information leak alone, KT's 16,847 people fall far short of SK Telecom's 23 million and Coupang's 37.55 million. But if the penalty surcharge imposed on KT is simply converted per person leaked, it comes to about 3,243,800 won per victim. That is 560 times SK Telecom (about 5,800 won) and 195 times Coupang (about 16,600 won). This is seen as a result of the Personal Information Protection Commission setting the level of sanctions based on the severity of the violation and related revenue rather than the simple number of people leaked.
The Personal Information Protection Commission said, "While many past personal information leaks involved data being exposed to third parties without clear confirmation of direct damage, KT's case goes beyond a simple data leak and led to monetary damage, making the seriousness extremely high."
◇ Will KT file a suit to cancel the penalty surcharge following SKT? "We will decide after reviewing the written decision"
Attention is on whether KT will file an administrative lawsuit challenging the penalty surcharge. The Personal Information Protection Commission focused on the fact that the personal information leak led to monetary damage, but from KT's perspective, considering the overall scale of the leak, there is a view that it could argue the penalty surcharge per person is excessive. KT is said to have told the Personal Information Protection Commission that there is no direct causal link between the leakage of mobile phone numbers, subscriber identity numbers (IMSI), and device identity numbers (IMEI) and the micro-payments, and that while payments were made, they did not proceed to billing.
In the case of SK Telecom, which received a 134.8 billion won penalty surcharge from the Personal Information Protection Commission, it filed a complaint to cancel the disposition on Jan. 19. The penalty surcharge must be paid within 30 days of receiving the written decision, and under the Administrative Litigation Act, an administrative suit can be filed within 90 days from the date the disposition is served after paying the penalty surcharge.
A KT official said, "We take the Personal Information Protection Commission's disposition seriously and once again bow our heads in deep apology for causing great concern and anxiety to our customers and the public due to the incident," adding, "KT is overhauling its entire personal information protection system from the ground up, expanding security investments, and strengthening companywide personal information protection capabilities to prevent a recurrence and restore customer trust." However, regarding legal action, the official added, "As soon as we receive the written decision, we will thoroughly review its contents and then determine our position," leaving the door open.
◇ "Considering the secondary damage, the penalty surcharge is somewhat light" vs. "No reduction due to obstruction of the investigation"
Experts were split on the level of KT's penalty surcharge. Jang Hang-bae, a professor in the Department of Industrial Security at Chung-Ang University, said, "It is hard to weigh the severity of the penalty surcharge because the Personal Information Protection Commission prioritizes the seriousness of the damage from the personal information leak," but added, "Given that there was monetary damage in KT's case, the penalty surcharge came out somewhat light." Kim Seung-joo, a professor at the Graduate School of Information Security at Korea University, said, "While the Personal Information Protection Commission only saw the possibility of secondary damage in SK Telecom's case, KT actually saw secondary damage occur, so it appears the level of the penalty surcharge was raised," adding, "In particular, because the Personal Information Protection Commission determined KT obstructed the investigation, it appears no reduction was granted."
Experts said KT is likely to pursue an administrative suit to reduce the penalty surcharge. Professor Jang Hang-bae said, "Administrative litigation becomes a process in which corporations actively respond to seek reductions in the penalty surcharge." Kim Seung-joo, a professor at the Graduate School of Information Security at Korea University, also said, "KT is likely to file an administrative suit, citing that the secondary damage did not lead to billing and that compensation was provided."
Meanwhile, the Personal Information Protection Commission said that for LG Uplus, where a personal information leak occurred in Aug. last year, it decided to request an investigation by law enforcement, saying the company made it impossible to investigate by scrapping the server and reinstalling the operating system (OS). An LG Uplus official said, "A police investigation into the same matter is already under way," adding, "We will continue to fully cooperate with the police investigation."