INCIDENT REPORT · CP-2025-003

SK Telecom USIM data breach

L3 · ELEVATEDCONFIRMED

South Korea's largest mobile operator disclosed that malware on its core network had exposed subscribers' USIM data, including authentication keys.

Incident ID: CP-2025-003
Disclosure date: 22 APR 2025
Detection date: 18 APR 2025
Affected countries: South Korea
Plotted location: Seoul, South Korea (Affected organization headquarters)
Threat classification: Level 3 — ELEVATED
Classification rationale: Core telecom infrastructure compromise exposing SIM authentication data of roughly half the country's population.
Attack type: Data Breach
Nature: Malicious activity
Attack vector: Malware implanted on core network servers including the Home Subscriber Server (HSS); investigators found malware dating back to 2022
Sectors: Telecommunications
Critical infrastructure: Yes
Organizations affected: SK Telecom
Operational consequences: Korea's privacy regulator found data of 23,244,649 users was leaked, including phone numbers, IMSIs and USIM authentication keys; SK Telecom launched a nationwide free USIM replacement programme. The PIPC fined SK Telecom about 134.8 billion won in August 2025.
Estimated financial impact: PIPC fine of 134.8 billion won (reported as about US$97 million); this is a regulatory penalty, not a total cost.
Attribution (as stated): No official attribution recorded

SOURCE REFERENCES

RECORD CREATED 14 NOV 2026 · LAST UPDATED 14 NOV 2026 · Threat levels are editorial assessments, not official government ratings.

SK Telecom USIM data breach

L3 · ELEVATEDCONFIRMED

South Korea's largest mobile operator disclosed that malware on its core network had exposed subscribers' USIM data, including authentication keys.

Incident ID

CP-2025-003

Disclosure date

22 APR 2025

Detection date

18 APR 2025

Affected countries

South Korea

Plotted location

Seoul, South Korea (Affected organization headquarters)

Threat classification

Level 3 — ELEVATED

Classification rationale

Core telecom infrastructure compromise exposing SIM authentication data of roughly half the country's population.

Attack type

Data Breach

Nature

Malicious activity

Attack vector

Malware implanted on core network servers including the Home Subscriber Server (HSS); investigators found malware dating back to 2022

Sectors

Telecommunications

Critical infrastructure

Yes

Organizations affected

SK Telecom

Operational consequences

Korea's privacy regulator found data of 23,244,649 users was leaked, including phone numbers, IMSIs and USIM authentication keys; SK Telecom launched a nationwide free USIM replacement programme. The PIPC fined SK Telecom about 134.8 billion won in August 2025.

Estimated financial impact

PIPC fine of 134.8 billion won (reported as about US$97 million); this is a regulatory penalty, not a total cost.

Attribution (as stated)

No official attribution recorded