South Korea’s data protection watchdog slapped a KRW134.8 billion ($97.2 million) fine on SK Telecom (SKT) for lapses following a data breach of SIM-related information, compromising personal data of its entire user base.

The Personal Information Protection Commission (PIPC) said the penalty was imposed for failing to protect customer data and not reporting the incident immediately.

In a statement, PIPC noted the information of about 23 million customers was leaked due to “negligence in management” of key mobile communication networks and systems.

An investigation found the incident was caused by SKT’s “failure to adhere to basic security measures and management laxity”.

It argued the operator neglected to detect and respond to data breach attempts, including failing to review the intrusion detection system’s abnormal activity logs, despite confirming hackers had accessed a server in February 2022.

The commission also ordered SKT to take corrective measures to strengthen overall system inspections and set up a company-wide personal information governance system.

PIPC chair Ko Hak-soo said: “I hope that this incident will serve as an opportunity for businesses that hold and process large amounts of personal information to recognise the related budget and human resources investment as a necessary investment rather than a simple expense.”

The fallout
Following a three-month joint public-private investigation, the Ministry of Science and ICT last month fined SKT KRW30 million for negligence for the large-scale data breach. The agency also ordered the operator to conduct quarterly audits, boost internal security resources and assign direct oversight of data governance to the CEO.

At the same time, the operator unveiled a plan to spend KRW700 billion to overhaul its security systems.

The company’s Q2 net profit fell to KRW83 billion from KRW350 billion a year earlier, as it spent KRW250 billion on one-time expenses for customer SIM replacements and compensation for retail store losses.

SKT lowered its annual revenue guidance from KRW17.8 trillion to KRW17 trillion, with CFO Kim Yang-seob noting its 2025 profit is expected to decline significantly year-on-year.

The operator loss nearly 750,000 mobile customers in Q2, closing June with 22.1 million subscribers.