SK Telecom Breach Exposes Millions of SIM Records After Years of Undetected Access

Nearly 27 Million SIM Records Exposed

Hackers stole 9.82 gigabytes of sensitive SIM information from SK Telecom, South Korea's largest mobile carrier, after an intrusion that investigators traced back to August 6, 2021. The company discovered the breach in April 2025, leaving attackers with access that went undetected for years.

As of July 6, 2025, the fallout includes government investigations, hundreds of thousands of customers moving to competitors, free SIM replacements and the possibility of a financial penalty exceeding 530 billion won. Police are working with authorities in five other countries, including the United States, to identify those responsible.

Nearly 27 million International Mobile Subscriber Identity records, known as IMSIs, were exposed. The stolen information included authentication data used to establish whether a SIM card belongs on the network. That makes the breach especially sensitive in a country where mobile phones support financial transactions, identity checks and access to essential services.

SKT is offering free SIM replacements to all 23 million customers and has pledged 700 billion won, about $514 million, for security improvements over five years. The difference between the number of exposed IMSI records and the replacement programme's customer count is about 4 million. Records can cover connected devices as well as people, so the figures describe different parts of the breach.

The company says names, addresses and financial account details were not exposed. No widespread fraud or misuse of the stolen information has been confirmed so far. Authorities nevertheless urge affected customers to replace their SIM cards and use additional protection services because authentication information can be valuable to criminals seeking control of a phone number.

How the Intrusion Developed

A joint investigation by the Ministry of Science and ICT and private cybersecurity specialists found that attackers had planted malware on SKT's internal servers as early as August 6, 2021. That was almost ten months earlier than investigators initially believed.

The investigation identified at least 27 variants of malware, including a sophisticated Linux backdoor called BPFDoor. A backdoor gives an intruder a hidden way to return to a computer system. Linux is an operating system widely used on servers, the computers that run network services.

BPFDoor allowed the attackers to remain hidden, evade traditional security measures and move between systems inside SKT's network. They eventually reached the Home Subscriber Server, or HSS, a central database that manages subscriber identities and authentication.

Investigators found weaknesses in SKT's network management systems. Vulnerabilities in third party software, including Ivanti VPN devices, were identified as a possible route into the network. A VPN provides a connection into a private network, making flaws in such equipment a serious concern when attackers are trying to reach internal systems.

The main dates show how long the incident developed before customers learned about it:

• August 6, 2021: The earliest malware installation identified by the joint investigation.
• April 2025: SKT discovered and publicly disclosed the breach.
• July 6, 2025: Investigations, customer protection measures and regulatory action remained under way.
• August 2025: SKT's announced customer support measures include a 50% discount on subscription fees.

What Was Taken and Why It Matters

The attackers removed 9.82 gigabytes of Universal Subscriber Identity Module data, commonly called USIM data. A USIM holds information used to identify a subscriber and authenticate their connection to a mobile network.

The exposed information included:

• IMSI numbers, unique identifiers associated with SIM cards.
• USIM authentication keys used to verify network access.
• Phone numbers.
• Device identifiers, with some evidence of exposure involving International Mobile Equipment Identity numbers, or IMEIs.
• Call detail records, known as CDRs.

An IMSI identifies the mobile subscription, while an IMEI identifies a device. Authentication keys serve a different purpose: they help the network check that a connection is coming from an authorised SIM. Losing those keys creates a more direct security concern than losing a phone number alone.

Investigators found that much of the sensitive information, including device identifiers and call detail records, was stored in plaintext, meaning it could be read without first unlocking it through encryption. SKT says its call detail records were encrypted.

Nearly 27 million exposed IMSI records exceeded SKT's active subscriber base. The total suggests that records associated with smartwatches, devices connected through the Internet of Things and possibly former customers were also affected. Internet of Things devices are everyday objects that connect to a network to exchange information.

SKT's statement that names, addresses and financial account details were not exposed still leaves customers facing risks linked to their mobile identity. A phone number often acts as a gateway to other services, particularly when an account sends a security code by text message.

How Stolen SIM Data Could Be Misused

Criminals with SIM authentication information could theoretically attempt to clone a SIM, intercept authentication codes sent by SMS or pursue SIM swap fraud. SIM cloning involves trying to reproduce a subscriber's credentials. SIM swap fraud involves taking control of a victim's phone number so that calls or messages reach the criminal instead.

Text messages matter because banks, online services and other accounts may use them to confirm a login or approve an action. Someone who gains control of the number receiving those messages may try to use the codes to enter other accounts.

Authorities have urged affected users to replace their SIM cards and register for stronger protection. Replacing the card invalidates the compromised authentication keys. The additional protection service is intended to bind the phone number electronically to the current SIM and prevent unauthorised transfers or swapping.

Customers also face the risk of phishing messages that exploit anxiety about the breach. A message pretending to offer a replacement card or security check can become another attempt to collect personal information. SKT's official communications and support channels are therefore central to the response.

Who Is Investigating the Attack?

South Korean police are cooperating with law enforcement agencies in five other countries, including the United States. Investigators have identified more than 100 suspicious IP addresses and sent international requests for information to 18 foreign corporations.

BPFDoor has previously been associated with advanced persistent threat groups, often called APT groups. Such groups typically have substantial resources, sometimes receive state support and seek to maintain access over long periods. The malware has been linked to Chinese groups including Salt Typhoon and Red Mansion.

Taiwanese cybersecurity company TeamT5 reported that hackers linked to China were exploiting vulnerabilities in Ivanti VPN devices globally around the same period as the SKT breach. South Korean businesses, including SKT, use Ivanti equipment.

Authorities have not officially identified a country or group responsible for the SKT attack. The entry route, the identity of the attackers and their purpose remain subjects of the investigation.

Lim Jong-in, a cyber defence specialist at Korea University, said operations involving prolonged, hidden access are typically associated with state actors seeking intelligence or a lasting presence inside a network, rather than ordinary criminals pursuing financial gain. His assessment places the duration of the intrusion at the centre of the concern.

Apologies and Support for Customers

SKT chief executive Ryu Young-sang apologised after the breach became public in April. He described the incident in stark terms:

the most severe security breach in the company's history.

SK Group Chairman Chey Tae-won also apologised and pledged to take full responsibility for any harm caused. The apologies were followed by measures intended to help customers protect their numbers, reduce their bills or leave the carrier.

SKT's announced customer measures include:

• Free SIM replacements for all 23 million customers through more than 2,600 retail stores.
• A 50% discount on August subscription fees for all customers.
• Stronger SIM protection services against unauthorised porting or swapping.
• Waivers of early contract termination penalties for affected customers.

Porting means moving a phone number from one carrier to another. Waiving termination penalties gives affected customers a way to change providers without paying the charge that would ordinarily apply when ending a contract early.

Hundreds of thousands of customers have already moved to rival carriers, while SKT's share price has fallen sharply. The company estimates that, if as many as 5 million customers leave, waived penalties and lost revenue together could exceed 7 trillion won, about $5.1 billion.

A Security Rebuild Costing 700 Billion Won

SKT has announced an Accountability and Commitment Program that commits 700 billion won, about $514 million, over five years to rebuilding information protection systems. The programme covers staffing, management responsibility, testing and technical safeguards.

The company plans to double its cybersecurity team and make the chief information security officer report directly to the chief executive. That changes where security concerns enter the management chain, giving the person responsible for information protection a direct reporting line to the company's leader.

The technical and organisational commitments include:

• Quarterly security audits and regular penetration tests, which simulate attempts to break into systems.
• Full encryption of USIM authentication keys, a practice already adopted by competitors KT and LG Uplus.
• Deployment of advanced endpoint detection and response tools to identify suspicious activity on connected computers and servers.
• A Red Team tasked with actively searching for vulnerabilities.

SKT has also established a 10 billion won fund, about $7.3 million, to support cybersecurity talent in South Korea. The initiative includes partnerships with universities and support for startups working in the field.

The plans address several weaknesses exposed by the intrusion: sensitive authentication information needs stronger protection, suspicious activity needs to be detected sooner, and security staff need the authority and resources to act.

Government Finds Failures in Security and Reporting

The Ministry of Science and ICT concluded that SKT was negligent in protecting subscriber information. Vice Minister Ryu Je-myung said the company had failed to meet its security obligations and had missed the legal requirement to report the breach within 24 hours.

The government response includes a fine of up to 30 million won for regulatory violations, alongside the possibility of much larger penalties under the Personal Information Protection Act. Authorities have also required quarterly security inspections and retention of system logs for at least six months.

Logs record activity inside a computer system. Keeping them gives investigators a record to examine when trying to establish how an attacker entered, where they moved and what information they accessed.

SKT must allow affected customers to cancel their contracts without penalties. The company has also been referred for criminal investigation over its failure to comply with orders to preserve data.

The Personal Information Protection Commission, or PIPC, is considering a potentially record fine. The amount could reach 3% of SKT's annual revenue, potentially exceeding 530 billion won. A final amount had not been set as of July 6.

Why Staffing and Investment Are Under Scrutiny

The PIPC has criticised insufficient cybersecurity investment among major Korean conglomerates and called for stronger staffing and budgets across industry. The SKT breach has made those concerns especially urgent because the company operates infrastructure used by millions of people.

A 2024 government survey found that only 8.7% of businesses believed they needed dedicated cybersecurity staff. Even among large companies, just 14% regarded such staffing as a priority.

Many businesses rely on information technology employees who divide their time between several duties. Only a minority have specialists working full time on security. Pay for cybersecurity professionals in South Korea also trails global standards, making recruitment and retention difficult.

The government has acknowledged these weaknesses and is pressing for reforms across industry. SKT's commitments to more staff, direct reporting to the chief executive and dedicated testing teams show how the company's response extends beyond replacing individual pieces of technology.

What Customers Can Do Now

Affected customers have several practical ways to reduce their exposure while the investigations continue. Authorities and specialists recommend replacing the compromised SIM and adding protection against attempts to take control of the number.

• Arrange a free SIM replacement through SKT's official channels to invalidate the exposed authentication keys.
• Register for SIM protection services intended to prevent unauthorised porting or swapping.
• Treat unexpected messages cautiously, avoid suspicious links and do not provide personal information in response to unsolicited requests.
• Log out of and back into important applications, update passwords and monitor financial accounts for unusual activity.
• Use authentication involving more than one check where possible, preferably with a method other than SMS.
• Follow official SKT and government updates for guidance and support.

Authentication involving multiple checks adds another step beyond a password. Choosing a method that does not depend on a text message reduces reliance on the phone number as the route into an account.

Customers considering a move to another carrier can also use the announced termination penalty waiver. Those staying with SKT can take up the replacement and protection measures while monitoring accounts connected to their mobile number.

A Telecom Failure With National Consequences

SKT's role extends beyond carrying calls and messages. Its network supports identity verification, financial activity and essential services, making the security of subscriber authentication information a concern for the country's wider digital infrastructure.

The prolonged intrusion has prompted concern about espionage, surveillance and disruption of essential systems. Government officials and cybersecurity specialists have called for stronger safeguards across telecommunications, while authorities are considering tougher rules, higher fines and mandatory security standards for operators.

Science Minister Yoo Sang-im described the significance of the breach for the wider industry:

This SKT breach is a wake-up call for the entire telecommunications industry and our national network infrastructure. As Korea's top mobile carrier, SKT must prioritize cybersecurity.

The international police investigation also reflects the difficulty of tracing attacks that involve infrastructure and companies in several countries. Cooperation with foreign authorities and requests to overseas corporations form part of the effort to identify the attackers.

For SKT, the immediate tasks are protecting customers, complying with government requirements and delivering the promised security rebuild. For subscribers, the concrete changes are replacement SIM cards, additional protections, a planned August discount and the option to leave without a termination penalty.

Key Points

• Hackers stole 9.82 gigabytes of USIM information, exposing nearly 27 million IMSI records.
• Investigators traced malware installation to August 6, 2021. SKT discovered the breach in April 2025.
• Exposed data included phone numbers, authentication keys and device information. SKT says names, addresses and financial account details were not exposed.
• No widespread fraud or misuse has been confirmed. Authorities urge SIM replacement and stronger protection.
• SKT is offering free replacements to 23 million customers, an August fee discount and termination penalty waivers.
• The company has pledged 700 billion won for security over five years and a separate 10 billion won talent fund.
• The PIPC is considering a fine potentially exceeding 530 billion won. Police have not officially identified the attackers.