[Edaily Reporter An Yu-ri ] KTCorporation has been fined 53.979 billion won for violating the Personal Information Protection Act in connection with a hacking incident involving its femtocells (small base stations) that occurred last year. The Personal Information Protection Commission (PIPC) also voted to file charges against KTCorporation, finding that the company obstructed the investigation by submitting false information during the probe.

The PIPC announced on the 30th that it held its 15th plenary meeting on the 29th and imposed a fine of 53.979 billion won on KTCorporation, where the personal information leak occurred, while also issuing a corrective order and recommendations for improvement.

The Commission’s investigation confirmed that, due to lax management of access controls to core mobile communication networks and systems via femtocells, the personal information (mobile phone numbers, IMSI, and IMEI) of 16,647 individuals was leaked, and text messages and calls on the mobile network were hijacked.

This figure represents the actual number of data subjects after removing duplicates—such as corporate accounts and multiple lines—from the initial 22,227 people who reported the breach.

It was also confirmed that this personal information leak resulted in unauthorized micro-payments totaling approximately 240 million won, affecting a total of 368 individuals.

The Personal Information Protection Commission (PIPC) deemed the incident extremely serious, as it represents a case where personal information leaked through a femtocell hack last year resulted in actual financial losses. Furthermore, the PIPC determined that KTCorporation had violated its obligation under the Personal Information Protection Act to implement security measures to prevent unauthorized access and security breaches via information and communications networks.

Furthermore, the Commission resolved to file criminal charges regarding acts that obstructed the investigation, such as the submission of false documents. In addition, the Commission decided to refer LG Uplus(032640)to law enforcement agencies for investigation, as the company had destroyed servers and evidence prior to the commencement of the investigation.