PRIVACY DETECTIVE · KT
KT rogue femtocell micropayment fraud (2025)
A certificate copied from a lost KT femtocell was planted in a home-made device that sat on KT’s network for about 11 months, intercepting phones’ traffic and the SMS/ARS codes for carrier micropayments. Leaked data turned into actual money loss: 368 people, about ₩240m.
Checked 2026-10-03
- Affected
- 16,647 people (de-duplicated, incl. MVNO)
- Data taken
- Phone · Device / subscriber ID · Other
- Confirmed money loss
- ₩240m
- Entry vector
- Rogue base station
- Attack → detection
- Not published
- Fines
- ₩54bn
- Proceeds recovered
- Not published
05 STEPS
Breach → taken → resold → money → who paid
- 1. HOW IT HAPPENED
How it happened — Copied certificate from a lost femtocell → home-made base station on the network → traffic interception
- 2. WHO GOT THE DATA
Who got the data — The device operator arrested by police; the person directing it still being traced (reported)
- 3. HOW IT WAS RESOLD
Was it resold — Not established by official sources
- 4. HOW IT BECAME MONEY
How it became money — Intercepted data used for carrier micropayments → gift certificates → cash (police)
- 5. WHO PAID THE LOSS
Who paid the loss — 368 users, about ₩240m (regulator). Compensation not confirmed in public records
TIMELINE
Time to detect, report and notify
- Attack start → detection
- — → — · Not published
- Detection → report
- Not published
- Detection → customer notice
- Not published
About 11 months of access. KT reported 5,561 people on 11 Sep, with further reports on 18 Sep and 17 Oct
DATA
What was taken, and what it enables
- Identity data
- Phone · Device / subscriber ID · Other
What this combination can be used for
- Identity data only → Spam, impersonation calls, targeted phishing (e.g. luring you into a reset)
Regulator: femtocell certificates valid for 10 years and no IP restriction (connections possible from other carriers and abroad); management was broadly deficient. News (citing officials) 2026-07
CRIME-AS-A-SERVICE
Roles confirmed in this case
- Equipment operator · 1 · LAW ENFORCEMENT
- Drove the rogue base station around victims’ areas; arrested at Incheon Airport on 16 Sep 2025 News (citing officials) 2025-09
- Organizer · ALLEGED
- Whoever planned and directed it is still being traced (reported). An accomplice claimed instructions from someone abroad — an unverified statement News (citing officials) 2025-09
○ Victim data stolen → ○ Brokered and resold → ○ Buyer takes over accounts → ○ Fraud or unauthorised payment → ○ Mule account → ○ Laundering → ● Cash-out
● step confirmed in this case · ○ not established (which does not mean it did not happen)
GEOGRAPHY
Location facts, kept apart
Login-IP countries can differ from an attacker’s nationality or base because of VPNs, proxies and hijacked devices. Nationality appears only for individuals named by investigators and is never generalised to a country.
LOSS & PROCEEDS
Victim loss and criminal proceeds
- Proceeds — stolen / recovered / frozen
- ₩240m / n/a / n/a
- Laundering channel
- Gift-certificate cash-out is the only confirmed route
- Confirmed use of proceeds
- Gift cards — Payments bought gift certificates that were turned into cash (police). Final use not disclosed News (citing officials) 2025-09
RESPONSE & ENFORCEMENT
Company response and enforcement
- Criminal referral · PIPC · 2026-07-29 · Ongoing
- Referred to prosecutors for obstruction, including deleted server logs and false statements (reported) News (citing officials) 2026-07
- Security spend before vs costs after
- Not public — security budgets and legal costs are not estimated
DETECTIVE RADAR
KT rogue femtocell micropayment fraud (2025) from other angles
△Origin DetectiveApplies · not analysed yet
△Distribution DetectiveApplies · not analysed yet
△Tax DetectiveApplies · not analysed yet
△Wage DetectiveApplies · not analysed yet
✓Privacy DetectiveThis page
△Regulation DetectiveApplies · not analysed yet
✓ analysed · △ applies, not analysed yet · not applicable: Cost Detective, Inflation Detective, Discount Detective, Value Detective, Hype Detective, Hogu Index, Ingredient Detective (food & drinks) · All axes on one page