CyphrQ
Menu

SK Telecom USIM Breach 2025: What Was Taken and the PIPC Fine

What was stolen in SK Telecom's 2025 USIM breach, how many subscribers were affected, what Korea's regulators found, and the PIPC's 134.8 billion won fine.

By CyphrQ.ai

Written with AI assistance and human editorial review. Every figure linked to its source.

Incident: April 202510 min read

What was the SK Telecom USIM breach? In April 2025, SK Telecom (SKT), South Korea's largest mobile carrier, found that attackers had copied USIM data, including the secret authentication keys stored for SIM cards, from a core network database. Korea's privacy regulator, the PIPC, fined SKT about 134.8 billion won in August 2025. It said the data covered 23,244,649 users after removing duplicates.

This is a case file for readers in Asia and beyond. You get the official record, the points where accounts disagree, and the checks to run on your own network.

Case file

Field Value
Organisation SK Telecom Co., Ltd. (SKT)
Region South Korea
Breach date Earliest documented compromise August 2021; the USIM data left the network on 18 April 2025 (PIPC, Korean)
Disclosed SKT reported the leak to the PIPC on 22 April 2025 (PIPC). MSIT says SKT notified KISA on 20 April 2025, after the 24-hour window (MSIT)
People affected 23,244,649 users (PIPC, de-duplicated). About 26.96 million records (PIPC and MSIT, counted by phone number and IMSI)
Data types 25 categories of USIM data, including phone numbers, IMSI and the USIM authentication keys (Ki, OPc); 9.82 GB. No device identifiers (IMEI) found leaked in MSIT's first findings
Penalty/action PIPC surcharge of 134.791 billion won (written 1,347억 9,100만 원 in the release) plus a 9.6 million won administrative fine, decided 27 August 2025
Regulator Personal Information Protection Commission (PIPC); Ministry of Science and ICT (MSIT) ran the technical investigation
Status PIPC sanction announced 28 August 2025. We could not read a primary source on payment or appeal, so we make no claim about either

What data did the SK Telecom USIM breach expose?

A USIM is the chip in your SIM card. It holds an identity (the IMSI) and a secret key, called Ki, that proves to the network the SIM is genuine. The carrier keeps a copy of each key in a database called the HSS (home subscriber server).

According to the PIPC, attackers pulled 9.82 GB from the HSS on 18 April 2025. It held 25 types of information, including phone numbers, IMSI and the authentication keys Ki and OPc (PIPC). MSIT's final findings give the same size and 25 categories (MSIT).

Why the keys matter: a copy of Ki and the IMSI is the raw material for cloning a SIM. The page I read from SKT, a July 2025 press release, says it set up a compensation process for damage "from SIM cloning" and offered free SIM replacement (SKT). Neither regulator page I read says cloning actually happened to any customer.

What MSIT could not rule out: two servers held IMEI numbers and personal data in plain text, and one held plain-text call detail records. Logs for earlier periods are missing, so MSIT says leakage then cannot be ruled out (MSIT).

How many SK Telecom subscribers were affected?

The figures differ by source, because they count different things.

Source Figure What it counts
PIPC 23,244,649 users LTE and 5G users, including MVNO (virtual operator) users, with duplicates removed (PIPC)
PIPC and MSIT About 26.96 million Records, counted by phone number and IMSI (MSIT)
SKT 24 million customers Those eligible for its customer package, covering SKT and MVNO users. It is a programme size, not a breach count (SKT)

We use the PIPC's 23.2 million for people, and 26.96 million for records.

How did the attackers get into SK Telecom's network?

MSIT's final investigation sets out a long timeline (MSIT). The pages I read do not say how the attacker first got in, and I found no attribution to a named group.

Date What happened (MSIT)
6 Aug 2021 Earliest documented compromise: attacker reached "Server A" and installed CrossC2
24 Dec 2021 to 1 Jan 2022 Attacker logged into the HSS management server and planted BPFDoor on it and related HSS nodes
23 Feb 2022 An abnormal reboot led to an inspection and malware removal, but the required incident report was not filed
Jun 2022 WebShell and more BPFDoor payloads placed in the customer-management subnet
30 Nov 2023 to 21 Apr 2025 Attacker returned periodically and updated its tools
18 Apr 2025, 11:20 p.m. SKT detected unusually large outbound traffic; USIM data had left through "Server C"
23 Apr to 27 Jun 2025 Joint public-private team inspected all 42,605 SKT servers

Final count: 28 infected servers and 33 malware variants (27 BPFDoor, 3 TinyShell, 1 WebShell, 1 CrossC2, 1 Sliver). The first MSIT update on 29 April had found 5 servers and four BPFDoor variants (MSIT). The count grew as the search widened.

The PIPC describes the 2022 event slightly differently: SKT "detected an attacker accessing the HSS server but did not investigate further." MSIT adds that one of six log files was reviewed. Both say the same thing in effect: a warning in 2022 did not lead to a full clean-out.

What did the PIPC find, and how large is the SK Telecom fine?

The PIPC met on 27 August 2025 and published its decision on 28 August. The sanctions (PIPC):

  • Surcharge: 134.791 billion won (written 1,347억 9,100만 원), about 134.8 billion, for failing to take required safety measures.
  • Administrative fine: 9.6 million won, for not notifying users within the 72 hours the law requires.

The PIPC's findings on safety measures, in its words as summarised:

  • Network separation: internet and internal networks were not properly separated, and internal management servers were reachable from the internet without restriction.
  • Stored credentials: credentials for about 4,899 accounts across about 2,365 servers were stored without password protection. HSS data could be queried without authentication.
  • Patching: an operating system flaw (DirtyCow) with a patch available since October 2016 was not fixed. Antivirus was not installed.
  • Encryption: 26,144,363 Ki values were stored in plain text. The PIPC notes SKT knew that LG U+ (since 2011) and KT (since 2014) encrypted theirs.
  • Logs: intrusion detection logs were not reviewed and access logs were not retained.
  • Privacy officer scope: SKT's Chief Privacy Officer covered only the IT area, not the network where the leak occurred.

On notification, SKT told users of a "possible" leak on 9 May 2025 and of a confirmed leak on 28 July 2025.

The PIPC ordered SKT to strengthen network safety measures and restructure governance so the privacy officer oversees all personal data processing. It asked for a prevention plan within three months, and recommended extending ISMS-P certification to the mobile core network.

What did the government investigation add?

MSIT, the ministry that ran the joint investigation, reached its conclusions separately from the PIPC. Its final findings (MSIT) include:

  • Security spend: SKT had 15 security staff and KRW 3.79 billion per million subscribers, against a telecom average of 17.7 staff and KRW 5.74 billion.
  • Supply chain: contractor software with dormant malware was installed on 88 servers.
  • Reporting: MSIT cites late reporting, a missed 2022 report, and a breach of its preservation order, which it referred for criminal investigation.
  • Contract exit: MSIT ruled that subscribers can use SKT's terms to leave without an early-termination penalty, confined "to SK Telecom and this specific breach".

The final MSIT page states no date in its text. A file name suggests July 2025; we have not relied on that.

What has SK Telecom said and done?

On 4 July 2025 SKT said it "acknowledges the findings of the joint public-private investigation" and apologised. It announced a KRW 700 billion information protection investment over five years, a KRW 500 billion customer benefits package, and cybersecurity insurance raised from KRW 1 billion to KRW 100 billion in coverage (SKT).

In a filing with the US SEC that appears to be its FY2025 annual report, SKT says operating profit fell 41.1% to KRW 1.07 trillion, partly because of costs tied to the incident, including USIM replacement (SKT filing, US SEC). The report attributes the fall to several factors, so the breach is not the whole of it.

Going deeper: for security and IT teams

Threat model. A patient intruder wants subscriber identity material at scale. It does not need a zero-day. The documented gaps are ordinary: flat networks, plain-text passwords on servers, an unpatched 2016 kernel flaw, and a crown-jewel database that accepted queries without authentication. What it gets is the keys that anchor SIM authentication for tens of millions of lines.

Techniques, mapped to MITRE ATT&CK pages we opened.

Observed (PIPC or MSIT) ATT&CK entry
Passwords stored in plain text on servers T1552.001 Credentials In Files (Credential Access, TA0006)
One WebShell among the malware T1505.003 Web Shell (Persistence, TA0003)
27 BPFDoor variants S1161 BPFDoor, a Linux backdoor

MITRE lists BPFDoor behaviours such as attaching a Berkeley Packet Filter to watch TCP, UDP or ICMP traffic for "magic" bytes (T1205.002 Socket Filters), editing iptables rules to open a shell port (T1686), and setting HISTFILE to /dev/null to hide commands (T1690). The same page notes it first appeared in 2021 and is a passive, long-term backdoor. It gives no mitigation guidance, so the controls below come from the regulators and the technique pages.

Controls that would have broken the chain.

  • Encrypt the keys. Ki stored in plain text was the PIPC's central finding, and MSIT cites GSMA guidance and peer carriers' practice. Encrypt Ki and related key fields, as MSIT recommends.
  • Segment management from internet. The PIPC found the management network could reach the HSS unnecessarily. Deny by default; allow named paths.
  • No stored passwords. For T1552.001, MITRE lists M1047 Audit (search for files holding passwords), M1027 Password Policies and M1022 Restrict File and Directory Permissions. MSIT asks SKT to restrict password recording, encrypt where unavoidable and add MFA.
  • Patch and cover with endpoint detection. MSIT asks for wider EDR and antivirus coverage and quarterly vulnerability scans.
  • Log retention. MSIT notes firewall logs were kept four months against a six-month rule, and that missing logs stopped it ruling out earlier leakage. Retain logs centrally for at least six months.
  • Zero trust architecture. MSIT names it as a requirement. CISA's Zero Trust Maturity Model is a public roadmap.

Detection and evidence. SKT's own trigger was abnormal outbound volume on 18 April 2025. Alert on that, but also hunt for the older signals. For web shells, MITRE's detection strategy DET0394 flags unexpected files in web directories followed by a web server process launching a shell. For BPFDoor, review hosts for unexpected BPF socket filters and iptables rule changes. The 2022 episode shows the harder point: a removed implant with no full log review and no report left the actor in place for three more years.

What to verify or ask.

  • Where are our SIM, subscriber or identity keys held, and are they encrypted at rest?
  • If an endpoint shows an implant, does our playbook require a review of every log source, not one?
  • Can any management host reach our crown-jewel database, and can that database be queried without authentication?
  • Do contractors' tools get scanned before they reach servers?

What can you fix first, based on the SK Telecom findings?

  1. Find where your most sensitive keys or credentials are stored, and confirm they are encrypted.
  2. Search servers for plain-text passwords (MITRE M1047) and remove them.
  3. Check the path from management networks to your core databases and cut the unneeded ones.
  4. Keep logs centrally for at least six months.
  5. Rehearse the clock: know who tells the regulator, and by when. The PIPC fined SKT separately for missing the 72-hour notice.

Learn more

Key takeaways

  • The PIPC fined SK Telecom 134.791 billion won (about 134.8 billion) plus 9.6 million won, decided 27 August 2025.
  • The PIPC counts 23,244,649 users; both the PIPC and MSIT count about 26.96 million records. The 9.82 GB included USIM authentication keys.
  • MSIT says the first compromise was in August 2021 and found 28 infected servers and 33 malware variants.
  • The findings are mostly basics: plain-text keys and passwords, weak network separation, an unpatched 2016 flaw, and logs nobody reviewed.
  • We could not confirm from a primary source whether SKT has paid or appealed.

Sources