INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

KT Fined $39 Million for Customer Data Breach Incident

| 2026-07-30 22:28 CRITICAL LOW DATA BREACH
JSON
Executive Summary
AI-generated
On October 8, 2024, a nearly 11-month internal network compromise at KT Corporation persisted until September 5, 2025. The Personal Information Protection Commission (PIPC) fined the company KRW 53.979 billion ($39 million) for data protection violations following an investigation that began on September 10, 2025, after user reports of fraudulent micropayments. Approximately 16,647 KT subscribers had their personal information exposed due to the breach, resulting in at least 368 customers experiencing fraudulent mobile payments totaling KRW 240 million ($167,400). The attackers exploited a lost cellular base station called a femtocell, which contained a valid authentication certificate that was not restricted by source IP addresses or expiration date. This allowed them to intercept communications between users' devices and KT's core network for nearly an entire year without being detected.
Technical Mitigations AI-generated
• Limit femtocell certificate validity to a shorter period, such as 6 months. • Restrict connections by source IP addresses for femtocells and other telecommunications equipment. • Implement logging and monitoring of network traffic on all servers, including those infected with BPFDoor malware.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
BPFDoorBPFDoor
Target & Sectors
KR
governmentgovernment telecommunicationstelecommunications
Incident Timeline
‎March 2024
Threat actors using the stealthy Linux and Solaris backdoor BPFDoor evaded detection for more than five years before being linked to the China-nexus Red Menshen espionage group.
infrastructure Linux
BPFDoor is a stealthy Linux and Solaris backdoor publicly documented in 2022 that evaded detection for more than five years.
‎September 10, 2025
Threat actors used BFDoor malware to compromise 38 KT IT service network servers in March 2024.
victims 5,500 customers
A day later, the company filed its initial data breach notification, reporting that data of roughly 5,500 customers had been exposed.
infrastructure 38 KT network servers
BFDoor malware infection During the investigation, PIPC also discovered that 38 KT IT service network servers had been compromised by malware, including BPFDoor, in March 2024.
‎2026/07/30
South Korea's Personal Information Protection Commission fined telco giant KT Corporation $39 million for customer data breach.
financial $39 KT
South Korea fines telco giant KT $39 million for customer data breach.
Tactical Metrics
Metrics
financial
39,000,000
Kt
South Korea fines telco giant KT $39 million for customer data breach.
Metrics
victims
5,500
Customers
A day later, the company filed its initial data breach notification, reporting that data of roughly 5,500 customers had been exposed.
Metrics
infrastructure
‎Linux
Affected Product
BPFDoor is a stealthy Linux and Solaris backdoor publicly documented in 2022 that evaded detection for more than five years.
Metrics
infrastructure
38
Kt Network Servers
BFDoor malware infection During the investigation, PIPC also discovered that 38 KT IT service network servers had been compromised by malware, including BPFDoor, in March 2024.
Intelligence Sources
BleepingComputer 2026-07-30