South Korea fines KT Corp $37.4 million over data leak

South Korea’s Personal Information Protection Commission fined KT Corp 54 billion won, about $37.43 million, after concluding the telecom was responsible for a customer data leak tied to illegal small base stations. The decision lands as one of the country’s sharpest privacy penalties against a telecom operator that handles vast amounts of subscriber data and payment traffic.

Investigators linked the breach to rogue femtocells, unauthorized miniature base stations that let hackers siphon personal information from KT customers and route unauthorized micro-payments. Korean outlets reported that 16,647 people were affected, giving the case a precise scope that moved it far beyond a routine security lapse. The commission also ordered KT to take corrective measures.

The fault line in the case was operational, not abstract. KT’s network environment allowed the illegal base stations to sit close enough to intercept data and misuse payment functions, exposing a failure to block a threat model long associated with mobile-network abuse. That combination, customer information and financial transactions, is what makes telecom breaches especially damaging: one weak point can touch identities, account activity and billing at the same time.

Regulators also treated the response as part of the offense. Chosun reported that the watchdog cited evidence destruction and referred the matter for prosecution over alleged obstruction, while DigitalToday said the regulator filed a complaint over obstruction. That step signals a harder enforcement posture, one that reaches beyond a fine and toward personal accountability when investigators believe a company did not handle the breach properly.

The penalty, reported by KBS World and Aju Press at 53.98 billion won or 53.979 billion won, marks another major privacy enforcement action in South Korea’s digital economy. Just weeks earlier, the country imposed a $409 million fine on Coupang in what officials described as its largest data breach penalty, underscoring how aggressively privacy regulators are moving against companies that fail to secure customer information.

For KT, the damage is financial and reputational. Telecom groups sell reliability as much as connectivity, and a case involving rogue femtocells, stolen personal data and unauthorized payments cuts directly into that trust. The scale of the fine now gives other firms in South Korea’s mobile and cloud-heavy economy a clear warning: weak cybersecurity compliance can turn a technical lapse into a regulatory crisis.