String of major data breaches raises serious questions about Korea's cybersecurity

By Im Yoon-seo Posted : September 19, 2025, 16:53 Updated : September 19, 2025, 16:54
ㅁㄴㅇㄹ
Vice Minister Ryu Je-myeong of the Ministry of Science and ICT (right) and Financial Services Commission Vice Chairman Kwon Dae-young bow in apology at a press conference held at the government complex in central Seoul on Sept. 19, 2025. Yonhap

SEOUL, September 19 (AJP) - South Korean officials bowed their heads in apology during a televised press conference Friday but offered little comfort to a highly connected society grappling with yet another string of mass data breaches.
 

"The government is coordinating across agencies to minimize damage and prepare fundamental measures rather than temporary responses," said Vice Minister Ryu Je-myeong of the Ministry of Science and ICT.

"In light of these incidents, we will immediately begin thorough inspections of security practices and pursue fundamental institutional improvements to prevent recurrence," added Financial Services Commission Vice Chairman Kwon Dae-young.
 

The joint briefing came as multiple hacking incidents, spanning both government and corporate sectors, rattled public confidence. Wireless carriers SK Telecom and KT, as well as credit-card issuer Lotte Card, have all reported breaches this year, exposing the personal data of millions.
 

On April 18, SK Telecom confirmed that its internal servers had been attacked. A government probe of 42,605 servers through June revealed that 26.96 million sets of SIM card data (9.82GB) had been leaked, including phone numbers and subscriber identity codes (IMSI). Some servers also contained unencrypted device numbers (IMEI), names, and call records.
 

Rival carrier KT uncovered breaches between June 1 and Sept. 10 while reviewing its mobile payment service. Investigators found that fake base stations had been used to capture phone numbers, IMSI, and IMEI codes. The hack caused 2.4 billion won ($1.7 million) in losses affecting 362 people, while 20,030 customers were exposed to rogue stations. KT also reported six additional cases of server intrusion.
 

Meanwhile, Lotte Card disclosed that attackers infiltrated its online payment servers between Aug. 14 and 27. Detected on Aug. 31, the breach compromised data on 2.97 million of its 9.6 million members, including card numbers, expiration dates, and security codes (CVC). For about 280,000 users, even partial PINs were exposed. What was first reported as a 1.7GB leak was later confirmed to be 200GB.
 

These breaches are alarming not only for their scale but also because they struck Korea’s dominant telecom operators and one of its largest credit card issuers. Both SK Telecom and KT invest heavily in cybersecurity — spending 93.3 billion won (4.4% of IT budget) and 125 billion won (6.3%), respectively, in 2024 — levels close to the global average of around 5 percent.
 

Yet the recurrence of large-scale leaks underscores glaring vulnerabilities in Korea’s digital defenses. Beyond eroding trust in individual firms, the incidents raise deeper concerns about the resilience of South Korea’s broader digital ecosystem.

기사 이미지 확대 보기
닫기