South Korea’s privacy regulator fined KT Corp. ₩53.97 billion (approximately $37.6 million) on Wednesday and voted to refer both KT and rival LG Uplus to criminal investigators — not for being breached, but for what each company allegedly did afterward. KT deleted access logs from ten malware-infected servers while regulators were watching. LG Uplus allegedly decommissioned and reinstalled operating systems on key evidence servers after Korea’s national cybersecurity watchdog had flagged a suspected intrusion. Exchange rate as of July 30, 2026; all KRW conversions in this article are approximate.
The dual referrals, approved at a July 29 plenary session of the Personal Information Protection Commission (PIPC), represent a significant escalation in South Korea’s telecom enforcement posture. In the past, carriers that concealed breaches risked only a trivial administrative fine — a maximum of ₩30 million (approximately $20,883) for delayed notification. Now, for the first time, South Korea’s privacy regulator has referred two of its three major mobile carriers to prosecutors for criminal investigation in the same week.
Rogue Femtocells Ran Undetected for Eleven Months
The breach that prompted KT’s fine began in August 2024, when attackers acquired a lost KT-operated femtocell — a small, low-power cellular base station typically used to fill coverage gaps inside buildings — and extracted its authentication certificate. What made the attack possible was a systemic design failure: KT had deployed thousands of femtocells across its network using shared certificates stored in plaintext on each device, without root password protection and with SSH enabled for remote access.
Once attackers had the certificate, they cloned it onto counterfeit hardware and connected their rogue devices to the Seoul metropolitan area and surrounding Gyeonggi Province. KT’s core network accepted the imposters as trusted devices — because the certificate matched. From that point, the attack exploited a fundamental feature of how cellular networks encrypt traffic. Mobile communications are encrypted only between the handset and the base station. Decryption happens inside the femtocell itself. An attacker who controls the hardware can read all traffic passing through it in plaintext, including IMSI numbers, IMEI identifiers, SMS messages, and phone call records. KAIST Professor Yongdae Kim, an IEEE Fellow and mobile security researcher, explained the structural implication of this design: the femtocell’s internal decryption means any operator of that device has real-time visibility into every communication it handles.
The rogue stations, operating within a roughly 10-meter (33-foot) radius, captured the International Mobile Subscriber Identity numbers, device identifiers, and phone numbers of 16,647 KT subscribers — including customers of mobile virtual network operators that resell capacity on KT’s infrastructure. Attackers ran operations primarily during early morning hours to reduce the chance of detection. The operation continued for approximately eleven months before anyone caught it.
The harvested credentials were not kept dormant. The PIPC confirmed that 368 subscribers suffered unauthorized mobile micropayment transactions totaling approximately ₩240 million (approximately $167,000). Micropayments in South Korea’s mobile billing ecosystem are authorized via SMS authentication codes — which the rogue femtocells were already intercepting. Regulators said the direct translation of stolen data into real financial harm made this case particularly serious, setting it apart from breaches where exposure never led to documented victim losses.
BPFDoor Found on 38 KT Servers — Same Malware as SK Telecom
The femtocell breach was not the only security problem regulators uncovered when they inspected KT’s infrastructure. During a full-scale examination of KT’s servers, PIPC investigators found that 38 servers connected to personal information processing systems had been infected with multiple strains of malware, including BPFDoor — the Linux backdoor that also infected SK Telecom’s network in a breach that exposed data linked to approximately 27 million users and resulted in a ₩134.7 billion (approximately $93.8 million) PIPC fine in August 2025.
BPFDoor is not conventional malware. It operates at the kernel level by attaching to the Linux Berkeley Packet Filter — a feature normally used by administrators for packet monitoring — and installs a custom filter that silently inspects all inbound network traffic. The backdoor does not open any network listening port, meaning routine port scans show nothing unusual. It activates only when it receives a specially crafted “magic packet” embedded in otherwise normal-looking traffic. Once triggered, it can open a reverse shell or redirect connections, allowing attackers to move laterally through the compromised network. Because it lives in system memory and deletes its binary after execution, post-incident forensic recovery is difficult.
PwC Threat Intelligence and Trend Micro have both attributed BPFDoor to Red Menshen, also tracked as Earth Bluecrow, a Chinese advanced persistent threat group with a documented pattern of targeting telecommunications providers across South Korea, Hong Kong, Myanmar, Malaysia, Egypt, and the Middle East. The presence of BPFDoor on servers at both SK Telecom and KT — South Korea’s two largest mobile carriers — raises a question that neither company nor investigators has yet answered publicly: whether these are separate intrusions by the same actor, or artifacts of a single coordinated campaign against Korean carrier infrastructure.
KT was aware of the BPFDoor infections no later than March 2025, when malware was detected on its mobile servers. Internal security staff escalated findings to senior executives. Despite this, KT did not notify government authorities as required under the Personal Information Protection Act. A PIPC official stated: “KT was aware of the malware infection on its servers in March last year but failed to report the security breach to the government. During a full-scale inspection of KT’s servers, we found signs suggesting an organized attempt to conceal the incident, including the deletion of logs from 10 compromised servers.”
The PIPC voted to refer KT for criminal investigation on three grounds: failure to report the security breach, deletion of access logs from compromised servers, and submission of documents containing inaccurate information during the regulatory probe.
KT accepted the administrative fine and apologized. “We are rebuilding our personal information protection system from the ground up and expanding security investment to prevent similar incidents and restore customer trust,” a company official said. The company stated it would review the regulator’s written decision before deciding whether to challenge it in court.
Evidence Destroyed Before Investigators Could Assess the Full Scope at LG Uplus
The LG Uplus referral tells a different story — one in which the evidence needed to answer the most important questions may never be recovered.
South Korea’s Korea Internet and Security Agency received an anonymous tip in July 2025 suggesting a possible breach of LG Uplus’s internal systems. The carrier was notified. But LG Uplus did not formally report the incident to regulators until late October — a delay of roughly three months, during which a critical window of forensic evidence was closed.
The breach originated in LG Uplus’s automated process policy management system, which controls access permissions across internal servers. A suspected third-party supply chain compromise allowed attackers to exfiltrate server configuration data, user authentication credentials, and employee records. The hacking publication Phrack subsequently claimed that attackers had infiltrated LG Uplus’s intranet and leaked the personal data of approximately 42,000 customers and 167 employees, though the company has not confirmed those figures.
A separate KnownSec leak, in which more than 12,000 classified internal documents from a Beijing-based firm with government ties were posted briefly to GitHub, included evidence suggesting that LG U Plus call records had been stolen by a Chinese hacking group. The connection has not been officially confirmed.
What investigators found when they eventually gained access was that several key servers — including the company’s integrated password management system — had been decommissioned or had their operating systems reinstalled between August 12 and September 15, 2025. This happened after KISA had alerted the carrier to the potential breach. One server submitted for forensic analysis showed inconsistencies with data provided by the original whistleblower, leading investigators to conclude that a second, undisclosed server had been the actual intrusion point — the one whose OS had been upgraded on August 12, making forensic recovery impossible.
Seoul Metropolitan Police had already raided LG Uplus’s Magok headquarters in mid-2026, seizing servers and system data. The PIPC’s July 29 police referral for suspected obstruction of official duties represents a further escalation on top of that existing criminal investigation.
The consequence of the evidence destruction reaches beyond the LG Uplus investigation itself. BPFDoor — found on SK Telecom’s servers in 2025, and now found on 38 KT servers — has been attributed to a Chinese APT group that systematically targets Korean carriers. Whether LG Uplus was also infected with BPFDoor or a similar backdoor is now structurally unknowable: the servers where that evidence would have existed were wiped before investigators arrived. South Korea’s three largest mobile carriers may all have been simultaneously compromised by the same threat actor, and the forensic record at one of them was destroyed before that question could be answered.
South Korea’s Fine Law Punishes Honesty More Than Concealment
The KT and LG Uplus cases have exposed a structural paradox in South Korea’s data protection enforcement framework.
Under the existing PIPA, the maximum administrative fine for failing to report a security breach within the required timeframe is ₩30 million (approximately $20,883). The maximum fine for a confirmed breach — calculated at up to 3% of relevant annual revenue — can reach tens or hundreds of billions of won. The practical implication: a company that successfully conceals a breach faces only a trivial fine if caught, while a company that reports promptly triggers the full severity of the penalty regime because the breach is on record and cannot be minimized. Under this structure, concealment is financially rational.
South Korea’s National Assembly passed amendments to PIPA in February 2026, raising the maximum penalty ceiling to 10% of total annual revenue for the most serious violations — repeat offenses within three years, incidents affecting more than 10 million individuals, or breaches resulting from failure to comply with a prior regulatory order. Those amendments were signed into law in March 2026 and will take effect on September 11, 2026.
The KT fine was assessed under the existing 3% ceiling and landed at ₩53.97 billion (approximately $37.6 million) — significantly below the maximum of approximately ₩190 billion that the PIPC could theoretically have levied. Regulators cited factors including the scale of the breach relative to the SK Telecom and Coupang cases, the corrective measures KT had already taken, and the company’s steps to compensate affected customers.
By comparison, the PIPC’s earlier fine against Coupang — ₩624.7 billion (approximately $434.8 million) for a breach affecting 37.5 million users — illustrates the scale of penalties theoretically available. Total PIPC fines reached ₩680.4 billion (approximately $473.6 million) in the first half of 2026 alone, compared to ₩167.8 billion (approximately $116.8 million) across all of 2025 — a near four-fold increase in a single calendar year.
The PIPC has separately announced plans to pursue legislative reform that would introduce explicit criminal penalties specifically for evidence concealment during data breach investigations. The KT and LG Uplus cases appear to have been the direct catalyst.
All Three Major Korean Carriers Now Under Simultaneous Scrutiny
The July 29 actions leave South Korea in a situation with no clear precedent in its telecom regulatory history: all three major mobile operators under active regulatory or criminal scrutiny at the same time.
SK Telecom, which disclosed the largest breach in April 2025 and was fined ₩134.7 billion (approximately $93.8 million), is challenging that fine in Seoul Administrative Court. KT is now subject to both an administrative fine and a criminal probe for log deletion. LG Uplus faces an ongoing police investigation and the new PIPC referral for server evidence destruction.
The overlap of these three investigations creates a structural problem for South Korea’s cybersecurity posture that goes beyond any single carrier. If BPFDoor or a similar persistent backdoor was present at all three carriers simultaneously — a possibility that the LG Uplus evidence destruction prevents from being confirmed or ruled out — then whoever was responsible had access to infrastructure serving essentially every major mobile subscriber in South Korea. The PIPC’s push for criminal accountability represents a recognition that the cover-up behavior, not just the underlying breaches, is the central regulatory failure to address.
Exchange rate used: USD 1 = ₩1,436.59 (mid-market, July 30, 2026). All KRW-to-USD conversions in this article are approximate and subject to change.
Frequently Asked QuestionsWhat is a femtocell, and how did attackers use one to breach KT?
A femtocell is a small, low-power cellular base station that carriers install in homes and offices to improve indoor signal coverage. It connects to the carrier’s mobile core network via a broadband internet connection, authenticated by a digital certificate. KT’s femtocells stored these certificates in plaintext with no root password and with SSH enabled, meaning anyone who obtained one device could extract the certificate and clone it onto counterfeit hardware. Because femtocells decrypt mobile traffic internally before forwarding it to the carrier’s network, an attacker controlling a rogue device can read every communication — subscriber identification numbers, device identifiers, SMS authentication codes — passing through it in plaintext. The rogue devices operated for approximately eleven months before detection.
What is BPFDoor, and why does its presence on KT servers matter?
BPFDoor is a Linux backdoor attributed to Red Menshen (also called Earth Bluecrow), a Chinese advanced persistent threat group that has targeted telecoms across South Korea, Hong Kong, Myanmar, and other countries. Unlike conventional malware, BPFDoor installs itself at the kernel level using the Linux Berkeley Packet Filter, opens no listening ports, and activates only on receipt of a specially crafted “magic packet” hidden in ordinary network traffic — making it essentially invisible to standard security tools. It was found on SK Telecom’s servers in the breach disclosed in April 2025, and investigators found it on 38 KT servers in the current case. The same malware appearing at South Korea’s two largest carriers raises the question of whether a coordinated campaign targeted multiple carriers simultaneously. That question cannot be definitively answered for LG Uplus, because the relevant servers were wiped before investigators could examine them.
Why did LG Uplus wipe its servers, and what does that mean for the investigation?
LG Uplus decommissioned and reinstalled the operating systems on key servers — including its integrated password management system — between August 12 and September 15, 2025, after South Korea’s national cybersecurity watchdog had already flagged a potential breach and notified the company. That timing is the basis for the PIPC’s referral for suspected obstruction of official duties. Practically, it means that the forensic evidence that would have shown how attackers entered LG Uplus’s systems, what data they accessed, and whether malware such as BPFDoor was present on carrier servers has been permanently destroyed. Seoul Metropolitan Police had already raided the company’s headquarters before the PIPC referral, but the evidence gaps created by the server wipes cannot be filled retroactively.
How will South Korea’s new data protection law change enforcement after September 2026?
South Korea’s amended Personal Information Protection Act, which takes effect September 11, 2026, raises the maximum administrative fine ceiling from 3% to 10% of total annual revenue for the most serious violations — those involving gross negligence affecting more than 10 million individuals, repeat offenses within three years, or failure to comply with a prior PIPC corrective order. Under this framework, a breach at a carrier the size of KT or LG Uplus could theoretically generate a fine ten times larger than what KT faces today. The new law does not retroactively apply to the KT or LG Uplus cases, but it governs every incident that occurs from September 11, 2026, onward — a date that South Korea’s carriers and every other company handling Korean subscriber data should treat as a hard reset on their exposure calculations. For a detailed breakdown of how those amendments were structured and what triggered them, see TechTimes’ coverage of the Coupang fine that preceded them.