Personal Information Protection Commission

Press Release

The PIPC Resolves its Deliberations on SKT to Inform Subscribers of Data Breach Immediately

- The PIPC held an emergency meeting on Friday, May 2, 2025 

- The PIPC calls for SKT to develop different privacy protection measures for the vulnerable to ensure higher accessibility 

- SKT is required to submit its results on measures taken to address the data breach

May 2, 2025

(This is an unofficial translation of a press release, originally prepared in Korean.)

The Personal Information Protection Commission (PIPC) held a plenary meeting in 2025 and reviewed the progress in its investigations into a data breach by SK Telecom Co., Ltd. (SKT) on May 2, 2025.

Hackers attacked SKT’s home subscriber server (HSS), resulting in a data breach that affected around 25 million subscribers in Korea. In this regard, the PIPC launched investigations into SKT. It showed that SKT reported its data breach after becoming aware of the incident where customers’ universal subscriber identity module (USIM) data was leaked. However, it only posted an announcement that some of its subscribers’ information is assumed to have been leaked on its website. SKT failed to notify every data subject individually regarding the data breach in accordance with statutory requirements as required by the Personal Information Protection Act (PIPA). 

Article 34-1 of the PIPA stipulates that a personal data processor should notify the data subjects of: 

• Particulars of the personal information leaked; 
• When and how personal data has been leaked; 
• Any information about how to minimize damages caused by the data breach; 
• Measures taken by the personal data processor and redress mechanisms; and 
• Help desk and contact details for the data subjects to reach out 

SKT sent text messages to all subscribers after the incident to provide details about how to join its USIM protection service and SIM replacements, along with an apology statement. However, it lacked the aforementioned information that a personal data processor is required to notify in case of a data breach, under the PIPA. Against this backdrop, civil complaints and petitions reported to the PIPC regarding SKT’s data breach are also surging

Moreover, the PIPA stipulates that business operators must develop countermeasures to minimize damages caused by a data breach and take the necessary measures accordingly. However, SKT’s countermeasures, proposed as USIM protection services and SIM replacements, have faced challenges due to a lack of USIM inventory and delayed responses. It has also caused a backlash because the countermeasures that SKT has chosen have not been implemented as planned.

Meanwhile, joining its free-of-charge USIM protection service or requesting SIM replacements are available only via a mobile application or on-site visits, making it difficult for the vulnerable, including the elderly and people with disabilities, to be redressed. This accessibility issue has led to another inadequate response to the data breach that already took place. 

In this regard, the PIPC held a plenary meeting to deliberate on and resolve a decision associated with SKT’s massive data breach. The decision by the PIPC aims to minimize the damage caused by the data breach and address concerns raised by the people by ensuring their rights to self-determination and choose as follows:

i) Make sure to notify all subscribers, including the affected subscribers, subscribers who have the potential to be affected, and those who are using budget carriers, of the data breach with statutory requirements included; 
ii) Make sure to come up with tailored measures for the vulnerable, including the elderly, and people with disabilities, and much-needed measures in the prevention of secondary damages of SKT subscribers; and
iii) Make sure to expand the staff and capacity of the dedicated team and operate it to deal with surging civil petitions associated with privacy concerns until the incident is sorted out.

The PIPC requested that SKT submit its results on measures taken to address the data breach within seven days and will monitor its implementation status to address privacy concerns and inconvenience. Moreover, the PIPC will provide information on how to safeguard personal information through multiple channels for SKT subscribers in their daily lives. The information on how to safeguard privacy is as follows:

i) Joining the USIM protection service; 

ii) SIM replacement; 

iii) Switching from USIM to eSIM; 

iv) Switching to another mobile carrier; and 

v) Changing phone number;

The PIPC is now expediting a thorough review of SKT’s systems associated with data processing. Through this thorough review, the PIPC aims to identify the epicenter of this massive data breach and the potential damages caused by the incident. Moreover, the data protection authority will place an emphasis on investigating SKT’s compliance status regarding the implementation of safeguards and other potential violations. Building upon these investigatory efforts, the PIPC will do its utmost to sanction SKT for violations and prevent data breaches from recurring.

* A PDF file, formatted for better readability, is attached.