South Korea's PIPC to Rule on KT Corp Sanctions Over Femtocell Data Breach
Regulators will determine fines under PIPA's 3% revenue penalty structure after breach exposed 22,227 subscriber lines and enabled fraudulent micropayments.
South Korea's Personal Information Protection Commission (PIPC) will hold a plenary meeting on July 29, 2026, to determine administrative sanctions against KT Corp following a data breach that compromised subscriber information through an illegal femtocell attack.
The commission will assess whether the telecommunications carrier violated the Personal Information Protection Act (PIPA) and establish the scale of fines, which could reach 195-200 billion won based on the law's maximum 3% penalty applied to KT's average wireless service revenue of approximately 6.5-6.7 trillion won.
Femtocell Attack Exposed Subscriber Data
Attackers deployed illegal small-cell base stations, known as femtocells, to exploit vulnerabilities in KT's network infrastructure. The breach leaked personal information linked to 22,227 KT subscriber lines, including International Mobile Subscriber Identity (IMSI) numbers, International Mobile Equipment Identity (IMEI) numbers, and phone numbers.
Korean news outlets including The Elec, ETNews, and Yonhap report that 368 victims suffered unauthorized micropayment transactions totaling approximately 243 million won. Sources vary on the specific number of fraudulent transactions, which has not been independently confirmed.
BPFDoor Malware Investigation Ongoing
PIPC is separately investigating KT's handling of BPFDoor malware infections that affected the company's servers between March and July 2024. The commission is examining whether KT failed to properly report 43 infected servers as required under Korean data protection regulations.
The dual investigation highlights systemic security vulnerabilities within one of South Korea's three major telecommunications carriers.
Regulatory Precedent and Industry Impact
PIPC typically approves corrective measures on the same day as plenary reviews in high-profile cases. Previous sanctions against companies like SK Telecom and Coupang have established precedent for how the commission applies PIPA's penalty framework.
The potential 195-200 billion won penalty represents one of the largest possible sanctions under PIPA's current enforcement regime. The case underscores the financial risks companies face under South Korea's revenue-based fine structure and the growing threat from specialized telecommunications attacks.
Industry observers note that the outcome will signal how aggressively regulators pursue telecommunications companies that fail to protect subscriber data from sophisticated attack vectors, including illegal base station deployments and server-side malware infections.
KT Corp has not publicly commented on the anticipated sanctions beyond acknowledging the ongoing PIPC review process.