PRIVACY DETECTIVE · SK TELECOM
SK Telecom SIM data breach (2025)
After an intrusion that began in 2021, SIM data for 23.2 million subscribers — phone numbers, IMSI and SIM authentication keys (Ki, OPc), 25 data items — left the subscriber server (HSS) in April 2025. The regulator treated SIM data as personal data and imposed its largest-ever fine at the time.
Checked 2026-10-03
- Affected
- 23,244,649 people (LTE/5G incl. MVNO, de-duplicated)
- Data taken
- Phone · SIM authentication key · Device / subscriber ID · Other
- Confirmed money loss
- None confirmed
- Entry vector
- Malware
- Attack → detection
- ~1,357 days
- Fines
- ₩134.8bn
- Proceeds recovered
- Not published
05 STEPS
Breach → taken → resold → money → who paid
- 1. HOW IT HAPPENED
How it happened — Intrusion Aug 2021 → malware in the authentication system Jun 2022 → mass exfiltration from the subscriber server 18 Apr 2025
- 2. WHO GOT THE DATA
Who got the data — Not established by official sources
- 3. HOW IT WAS RESOLD
Was it resold — Not established by official sources
- 4. HOW IT BECAME MONEY
How it became money — Not established by official sources
- 5. WHO PAID THE LOSS
Who paid the loss — The company pays the fine; no consumer money loss confirmed in public records
TIMELINE
Time to detect, report and notify
- Attack start → detection
- 2021-08 → 2025-04-19 · ~1,357 days
- Detection → report
- 3 days
- Detection → customer notice
- 100 days
Malware planted in the customer authentication system (ICAS) in June 2022; exfiltration from HSS on 18 Apr 2025. "Possible exposure" notice on 9 May, confirmed notice on 28 Jul
DATA
What was taken, and what it enables
- Identity data
- Phone · Device / subscriber ID · Other
- Authentication data
- SIM authentication key
What this combination can be used for
- Identity data only → Spam, impersonation calls, targeted phishing (e.g. luring you into a reset)
- Email + password, cookie or code → Account takeover, including other services sharing the password
The regulator found basic access controls missing, SIM keys stored in plaintext and a 2016 vulnerability (DirtyCow) unpatched. The initial entry route and the attacker were not identified in public records. Regulator 2025-08
CRIME-AS-A-SERVICE
Roles confirmed in this case
No perpetrator or role is established by official sources.
○ Victim data stolen → ○ Brokered and resold → ○ Buyer takes over accounts → ○ Fraud or unauthorised payment → ○ Mule account → ○ Laundering → ○ Cash-out
● step confirmed in this case · ○ not established (which does not mean it did not happen)
GEOGRAPHY
Location facts, kept apart
| Field | Value | Basis |
|---|
| Victim country | South Korea Per regulator decision | Confirmed by law enforcement Regulator 2025-08 |
Login-IP countries can differ from an attacker’s nationality or base because of VPNs, proxies and hijacked devices. Nationality appears only for individuals named by investigators and is never generalised to a country.
LOSS & PROCEEDS
Victim loss and criminal proceeds
- Victim money loss
- No amount established
RESPONSE & ENFORCEMENT
Company response and enforcement
- Customer notice · 2025-07-28
- Confirmed breach notice, over three months after detection — fined for late notification Regulator 2025-08
- Fine · PIPC · 2025-08-27 · Decided
- ₩134.8bn Failure to take security measures Regulator 2025-08
- Administrative fine · PIPC · 2025-08-27 · Decided
- ₩9.6m Late breach notification Regulator 2025-08
- Corrective order · PIPC · 2025-08-27 · Decided
- Company-wide security review within 3 months; extend ISMS-P certification to the network Regulator 2025-08
- Security spend before vs costs after
- Not public — security budgets and legal costs are not estimated
DETECTIVE RADAR
SK Telecom SIM data breach (2025) from other angles
△Origin DetectiveApplies · not analysed yet
△Distribution DetectiveApplies · not analysed yet
△Tax DetectiveApplies · not analysed yet
△Wage DetectiveApplies · not analysed yet
✓Privacy DetectiveThis page
△Regulation DetectiveApplies · not analysed yet
✓ analysed · △ applies, not analysed yet · not applicable: Cost Detective, Inflation Detective, Discount Detective, Value Detective, Hype Detective, Hogu Index, Ingredient Detective (food & drinks) · All axes on one page