What Happened

SK Telecom, South Korea's largest mobile carrier with roughly 34 million subscribers, disclosed in April 2025 that it had detected malware on its network capable of accessing sensitive Universal Subscriber Identity Module (USIM) data. The company said it identified the malware infection at around 11 p.m. on April 19, 2025, and reported the incident to the Korea Internet & Security Agency (KISA) the following day, April 20. SK Telecom also notified South Korea's Personal Information Protection Commission (PIPC) as part of its regulatory obligations.

What made the case especially notable was the timeline that later emerged during the investigation: rather than being a fresh intrusion, the malware responsible for the data exposure had first been introduced into SK Telecom's systems as far back as 2022, meaning attackers may have had some level of access to subscriber data for approximately three years before detection.

Scope of the Breach

Initial estimates suggested that USIM-related data belonging to nearly 27 million subscriber records had potentially been exposed. As the investigation matured, South Korean regulators ultimately determined that 23.2 million people were confirmed to have had their information compromised — still one of the largest breaches in South Korean corporate history given the country's population of roughly 52 million.

The data accessed through the malware included:

• International Mobile Subscriber Identity (IMSI) numbers
• USIM authentication keys
• Network usage data
• Contacts and SMS metadata stored in connection with SIM records

SK Telecom said it found no confirmed evidence that the stolen data had been actively misused for fraud at the time of its disclosure, though regulators and security researchers warned that USIM authentication data of this kind could, in principle, be used to facilitate SIM-swapping or cloning attacks, which attackers use to intercept calls and text messages, including one-time passcodes used for account verification elsewhere.

Attack Details

The breach centered on the theft of cryptographic material stored on and associated with USIM cards — the removable SIM chips that authenticate a subscriber's device to the mobile network and, in South Korea, are also commonly used for lightweight digital identity and payment verification. Because IMSI numbers and USIM authentication keys are the credentials mobile networks use to verify that a SIM card belongs to a legitimate subscriber, their theft raised concern about downstream risks such as unauthorized SIM cloning or interception of authentication codes tied to banking and other sensitive services.

South Korea's PIPC, following its formal investigation, concluded that SK Telecom had committed a series of basic security failures rather than having been defeated by a highly sophisticated attack. The regulator's findings, published alongside its penalty decision in August 2025, cited:

• Failure to adhere to proper access control protocols
• Inadequate management and oversight of access privileges across internal systems
• Absence of encryption protecting USIM authentication keys, which meant the keys were exposed in a more directly usable form once accessed
• Delayed breach notification, with SK Telecom found to have failed to report the incident within the legally required 72-hour window

Remediation and Response

In the aftermath of disclosure, SK Telecom moved to strengthen defenses around SIM security specifically. The company introduced enhanced monitoring designed to block illegal or unauthorized SIM card changes and to flag abnormal authentication attempts across its network. It also began offering a free "SIM protection service" that customers could opt into for additional account security, aimed at preventing unauthorized SIM swaps going forward.

The regulatory consequences were substantial. In August 2025, the PIPC imposed a record fine of approximately $97.2 million (roughly KRW 134.8 billion) against SK Telecom — one of the largest data-protection penalties ever levied in South Korea — citing the company's negligent security practices and the scale of the exposure. SK Telecom was separately fined an additional roughly $7,000 (KRW 9.6 million) specifically for its failure to report the breach within the mandated 72-hour window, a comparatively small figure that nonetheless underscored the regulator's finding that the company had not moved quickly enough once the malware was found.

Security researchers and South Korean officials pointed to several broader lessons from the case:

• Telecom operators storing SIM authentication material should encrypt that data at rest, not only in transit, given how directly it can be weaponized if stolen unencrypted.
• Continuous monitoring and log retention matter: a malware presence undetected for roughly three years suggests significant gaps in SK Telecom's internal detection and audit capabilities during that period.
• Regulatory reporting timelines are not merely procedural — South Korean regulators treated the delayed notification as a distinct, punishable failure separate from the underlying security lapses.
• Consumers affected by SIM-related breaches should enroll in carrier-provided SIM protection or fraud-monitoring services where available, since IMSI and key theft can enable attacks that are harder for individual customers to detect on their own.

The SK Telecom case remained one of the most significant telecom breaches globally in the period, both for the multi-year duration of the undetected malware presence and for the size of the resulting regulatory penalty.