[Edaily Reporter Han Kwangbeom ] LG Uplus(032640)stated that if allegations of covering up a hacking incident or obstructing the investigation are confirmed to be true, the company will take appropriate responsibility to protect its users. However, regarding whether to waive early termination fees for number portability, the company avoided giving a definitive answer, stating it would await the judgment of the judicial authorities.

Hong Beom-sik, CEO of LG Uplus, appeared as a witness at the National Assembly’s Science, Technology, Information, Broadcasting, and Communications Committee’s comprehensive parliamentary audit on the 23rd and stated, “Once the judicial authorities issue their ruling and the government provides guidelines, we will fulfill our appropriate responsibilities in accordance with them.”

When asked whether the company’s liability would be acknowledged if intentional concealment of the hacking were confirmed, CEO Hong replied, “If everything is proven to be true, liability will be confirmed,” adding, “We will certainly take appropriate responsibility for that.”

However, he did not propose any specific measures regarding the waiver of penalty fees or the retroactive refund of penalty fees already paid. LG Uplus is currently under investigation on suspicion of covering up the hacking incident or destroying evidence necessary for the investigation.

◇Ruling and Opposition Parties: “If Hacking Cover-Up Is Confirmed, Relief Such as Waiver of Penalty Fees Must Be Provided”

On that day, lawmakers from both the ruling and opposition parties urged the company to provide substantive remedies to users if it is confirmed that the hacking was covered up or the investigation was obstructed.

Hun Gi Lee, a lawmaker from the Democratic Party of Korea, repeatedly asked whether early termination fees for number portability would be waived if intentional concealment of the hacking were confirmed. Chairman Hong maintained his position that the company would abide by the judgment of the judicial authorities.

Rep. Cho Kyung-tae of the People Power Party pointed out that if the company intentionally concealed the hacking or obstructed the investigation, the company would be at fault for the contract termination. In response, Deputy Prime Minister and Minister of Science and ICT Bae Kyung-hoon also stated that if these facts are confirmed, the company would be at fault.

Democratic Party lawmaker Han Jun-ho also emphasized that if the company is found at fault, measures to protect users—such as waiving penalty fees and providing retroactive refunds—would be necessary. CEO Hong replied, “Once the judicial authorities issue their ruling, we will do our utmost to carry out the necessary actions to protect our customers.”

◇ Concerns Over Loss of Hacking Evidence Due to Server Reinstallation… LG Corp. Accused of “Inadequate Preservation”

LG Uplus’s measures for preserving evidence related to the hacking incident also came under scrutiny. Rep. Han Jun-ho pointed out that LG Uplus failed to notify the Korea Internet & Security Agency (KISA) in advance about the redundant structure of the servers suspected of being hacked, and that it reinstalled the operating system (OS) without securing an image of the infected server for forensic analysis.

In particular, he raised the possibility that the reboot following the OS reinstallation could have caused memory data to be lost and key evidence—such as malware or logs—necessary to identify the cause of the breach to be deleted.

LG Uplus explained that it had determined analysis would be possible by securing an image from just one server, as the data on the two servers was synchronized. However, Rep. Han countered that just because business data is synchronized does not mean that traces of the hacker’s intrusion would be identical on both servers. A KISA official also responded that the relationship between data synchronization and the consistency of digital forensic evidence can vary depending on the case.

Hong Kwan-hee, LG Uplus’s Chief Information Security Officer (CISO), apologized for the criticism that evidence preservation measures were inadequate. One lawmaker urged institutional reforms, noting that loopholes in the investigation process could prevent the full extent of the damage from being properly assessed.

LG Uplus’s method of informing customers about SIM card security measures was also criticized. Lawmaker Cho Kyung-tae criticized the company for failing to sufficiently explain to customers the necessity and urgency of automatic SIM updates. Deputy Prime Minister Bae stated that he would direct LG Uplus to provide more thorough guidance.

Seo Cheon-ho, a lawmaker from the People Power Party, took issue with LG Uplus using its “excellent” rating in the user protection evaluation for promotional purposes while under investigation for allegedly covering up the hack. In response, CEO Hong said, “I apologize for not scrutinizing the matter closely enough, as the lawmaker pointed out,” adding, “We will make improvements.”