[Edaily Reporter Yun Junghoon ] It has been argued that restoring customer trust, which has been eroded following a security incident, requires not merely the announcement of massive investments or a one-time apology, but rather remedial measures that customers can directly experience on the ground, along with a long-term verification system that transforms the entire management framework.

In a recent interview with the SKT Newsroom, Shin Min-soo, a professor in the Department of Business Administration at Hanyang University, stated, “A company’s response to a security incident must strictly distinguish between simply restoring normal operations and rebuilding customer trust,” as he assessed SKT’s response process over the past year following the hacking incident and the challenges that remain.

“Sincere, Personal Outreach” Built Trust More Than Announcements of Hundreds of Billions in Investment

Professor Shin cited examples of failed responses by overseas telecom companies as a point of comparison. A major British telecom company, B, announced a large-scale compensation settlement and security investments worth hundreds of billions of won, but subsequently suffered another breach. Regarding this, Professor Shin analyzed, “Promising an investment amount and actually preventing recurrence are two different matters,” noting that customer trust cannot be restored by merely announcing a figure.

In contrast, what stood out as a key differentiator in SKT’s case was that they personally visited elderly customers, people with disabilities, and those in remote or isolated areas to replace their SIM cards and assist with resetting their devices.

Professor Shin noted, “If protective measures require only app installation or online applications, this creates an additional burden for the elderly who are unfamiliar with digital devices or for customers who have difficulty traveling or accessing telecommunications services.” He added, “On-site and face-to-face support enhances both the effectiveness of protection and the fairness of procedures, and it aligns with the universal service responsibility borne by large telecommunications carriers. He noted, “Programs that integrate security, customer experience, and the protection of vulnerable groups into a single framework are rare even in Korea.”

On-site Confusion and Neglect of Long-Term Infiltration… “Establishing a Verification System Remains a Challenge”

However, Professor Shin pointed out two major painful limitations and future challenges revealed during this response process.

First is the failure to detect long-term infiltration and inadequate on-site preparedness. The infiltration went undetected for a long time; initial guidance did not sufficiently explain what customers should do; and on-site processing capacity was not prepared before the announcement of free replacements. Professor Shin emphasized, “Before announcing a protection policy, inventory, reservations, and the processing capacity of stores and call centers must all be prepared.”

Second is the effectiveness of the remedial measures and sustained accountability. Stabilizing metrics such as customer satisfaction or cancellation rates does not necessarily signify the complete restoration of trust. Professor Shin suggested, “While trust in technology and operations can be verified through concrete evidence showing that protective measures are functioning and controls have improved, trust in fairness and accountability depends on whether the company sufficiently acknowledges and compensates for the inconvenience and losses incurred—a judgment that may vary from customer to customer.” He added, “We must consider both external audits of control improvements and the outcomes of customer compensation to assess the depth of recovery.”

“Action, Not Just Words”… Six Principles for Restoring Trust: ‘6L’

Professor Shin proposed six key principles (6L) for companies to embed crisis response systems into their day-to-day business operations.

First is “Listening and Communication (Listen).” Companies must first listen to customers’ concerns and communicate both confirmed facts and unknown details in the customers’ own language. Next is “Establishing Multi-Layered Defenses (Limit).” Risks must be mitigated by layering multiple lines of defense, such as technical measures, physical replacements, and on-site support. Additionally, there is “Proactive Loss Absorption (Lose),” whereby the company must first bear the necessary costs and losses in business opportunities before imposing costs or inconvenience on customers; and “Fundamental Structural Improvement (Learn),” which requires linking the root causes of incidents to tasks that transform asset management, accounting, log management, partner management, and even executive decision-making processes.

Next is “Institutionalizing Accountability (Legislate),” which involves embedding commitments into the authority of responsible parties, implementation procedures, board reporting, and contractual obligations with partners. Finally, there is “Continuous Demonstration (Last).” Recovery must be continuously demonstrated through independent verification of improvement measures, long-term customer experience, and the outcomes of damage remediation.

Professor Shin stated, “Trust is determined not by a well-written apology, but by what the company takes on first and what it takes full responsibility for until the end,” adding, “Restoring trust must become an integral part of the company’s day-to-day operations, rather than a one-time apology or public relations effort.”