[Edaily Reporter Yun Junghoon ] Experts have analyzed that for companies to restore customer trust eroded by security incidents, they must go beyond one-time apologies or compensation campaigns and proactively shoulder the risks and financial burdens that customers would otherwise have to bear. In particular, SKTelecom’s response to the large-scale USIM data breach is regarded as a standard model for crisis management that companies should follow.

Professor Shin Min-soo of Hanyang University made these remarks while analyzing SKT’s response to the USIM data breach during a seminar titled “Corporate Management Crises and Responses,” hosted by the Korean Society of Media Management on the 28th. In his presentation that day, Professor Shin outlined the core principles and management strategies companies must follow to regain trust.

“The long lines at stores were a painful mistake, but… the decision to sacrifice operating profit restored trust”

During the SKT SIM card data breach that occurred last year, the initial response was marked by considerable confusion. Long lines formed outside stores as customers waited to replace their SIM cards, prompting a flood of criticism that the company was “causing inconvenience to consumers,” and customer anxiety reached a peak due to the uncertainty surrounding information disclosure in the early stages of the incident.

However, SKT adopted a bold “self-sacrifice” strategy in the midst of this crisis. Professor Shin cited SKT’s temporary suspension of new subscriptions—to concentrate its resources on retail stores—as a key factor in restoring trust. While this was a major decision for the company, involving the sacrifice of short-term revenue and operating profit, analysts note that it sent a strong signal to the market that protecting existing customers was its top priority.

The subsequent temporary waiver of early termination fees for customers who canceled their contracts was also evaluated as a measure that guaranteed customers genuine freedom of choice by having the company shoulder the financial burden associated with leaving the carrier.

In fact, these high-impact measures were validated by the metrics. According to Professor Shin’s analysis, SKT’s churn rate—which had surged to 1.6% immediately after the incident—subsequently stabilized at around 0.8%. Subscriber numbers also began to recover after hitting a low point, leading the company to maintain its top ranking in major customer satisfaction surveys, including those conducted by the Korea Management Association Consulting (KMAC).

Adding Sincerity Through Tailored Support for Vulnerable Groups and Independent External Verification

Another distinguishing feature of SKT’s response was the establishment of “tailored protection for the digitally vulnerable”—extending beyond the average customer—and an “independent verification system.” The implementation of tailored protection services that directly reached out to digitally marginalized groups—such as residents of remote islands and rural areas, the elderly, and people with disabilities—was cited as a rare best practice in the history of security incident response both domestically and internationally.

Furthermore, rather than limiting the response to internal measures, the company launched a “Customer Trust Committee” and a “Customer Advisory Group” composed of external experts to facilitate objective evaluations. In addition, it published an “Information White Paper” detailing the incident resolution process and institutionalized long-term governance reforms by having the Chief Executive Officer (CEO) personally declare that he would serve as the head of change management.

However, issues such as uncertainty in initial information disclosures and confusion during the on-site replacement process were pointed out as shortcomings that domestic companies must take to heart. The fact that legal disputes over liability—including lawsuits to overturn administrative fines—are still ongoing remains a challenge that must be resolved to fully restore trust.

Concluding his presentation that day, Professor Shin proposed six principles (6L) for restoring trust that companies experiencing large-scale security incidents must keep in mind.

Professor Shin listed the following: △ Listen first, then inform (communicate in the customer’s language) △ Multi-layered defense against risks (combining technology, operations, and on-site support) △ The company bears the costs first (accepting business interruptions and compensation) △ Link the cause of the incident to improvements in control systems △ Institutionalize promises into rules and systems △ Prove it over time.

Professor Shin stated, “Restoring trust in a company cannot end with a one-time apology or a show of compensation; it is a process of embedding customer protection measures into the actual management and operational framework and consistently demonstrating the results of those improvements over a long period of time.”