The SKT USIM Breach — When the Phone's ID Card Was Stolen

Where a Mobile Phone States "I Am This Subscriber"

This article is written in light of the 2025 SK Telecom incident in South Korea. On April 18, 2025, at 11:20 PM, South Korea's top mobile carrier, SK Telecom (SKT), detected an abnormally large data transmission heading out of the company (민관합동조사단 최종 조사 결과). What left was information that mobile phones use to prove who they are to the telecommunications network. Two entities investigated the incident. The Ministry of Science and ICT (MSIT), the government department in charge of telecommunications policy, formed a joint public-private investigation team, and the Personal Information Protection Commission (PIPC), the personal information regulatory agency, conducted a separate investigation and issued penalties (민관합동조사단 최종 조사 결과; 개인정보위 처분 발표).

To understand what left, we must first look at how a mobile phone connects to the network. A USIM is a small chip card inserted into a mobile phone, containing information that reveals to the telecommunications network which subscriber owns the phone. Among the information inside, two items lie at the center of this incident. The International Mobile Subscriber Identity (IMSI) is a number stored in the USIM that the carrier uses to recognize the subscriber. It is an identifier of the kind covered in "Personal Data and Anonymization — Erase the Name, and the Person Remains"—that is, information that points to a specific person by itself.

If the subscriber ID is a nameplate, proving that one is the person of that house is something else entirely. The Authentication Key (Ki) is a secret value shared equally in a single pair between the USIM and the carrier, acting as a key that the network uses to check whether this mobile phone is truly that subscriber. Traditional USIM authentication relies on such a fixed subscriber ID and a single secret shared between the two (DOI: 10.1145/3822567).

On the carrier's side, the place holding the matching partner to that key is inside the core network. The core network is the core telecommunications network responsible for user and terminal authentication and management, call connection, and data transmission. The Home Subscriber Server (HSS) is an authentication system within the core network that stores the subscriber's ID and authentication key, and checks whether the subscriber is correct when the mobile phone connects to the network. When a mobile phone requests a connection, the HSS and the mobile phone look up who the user is using the IMSI stored in each, and perform mutual authentication by comparing authentication values generated using the USIM authentication key (개인정보위 처분 발표). MSIT's Korean announcements call this server the "voice call authentication" server, while English announcements use the term Home Subscriber Server. Different names, but the same server (민관합동조사단 최종 조사 결과).

To use an apartment building analogy, the HSS is the management office that collects spare keys for all households into a single cabinet. The keys are separate for each household, but if that cabinet opens, all the spare keys go out at once. What makes us worry when copies of a key leak is USIM cloning. USIM cloning is the act of obtaining the authentication key contained in an original USIM to create another USIM that responds to the network's checks just like that USIM. The investigation team also noted that this leak placed subscribers at risk of USIM cloning (민관합동조사단 최종 조사 결과).

The PIPC evaluated that in a situation where verifying one's identity with a mobile phone has become commonplace, the large-scale leakage of subscriber IDs and USIM authentication keys has eroded trust in mobile telecommunications and spread social anxiety (개인정보위 처분 발표).

The public documents for this incident run in three directions. SKT's customer notices, press releases, and announcements are the documents of the party that caused the accident. MSIT's first investigation announcement and the investigation team's second and final announcements are government investigations, and transcripts of the question-and-answer sessions from two briefings also exist. Because transcripts consist of verbal answers from public officials, they provide weaker evidence than press releases. The PIPC's penalty announcement is the regulatory agency's investigation result. Following these documents, this article traces three things: what left and when, how the two agencies described the causes differently, and what is possible and what is difficult with the leaked keys.

The First Confirmed Infection, August 2021

On August 6, 2021, remote-control malware was installed on a system administration server connected to the internet (Final Investigation Results by the Public-Private Joint Investigation Team). Malware is a program created to cause harm without the user's knowledge, as covered in "Security — Unseen by Others, Unchanged in Secret, Open When Needed". The investigation team attached the qualifier "the earliest time among the infected servers confirmed during the investigation" to this date (Final Investigation Results by the Public-Private Joint Investigation Team).

At the end of 2021, the attacker used administration server account information to enter the HSS administration server, and planted BPFDoor on that server and the HSSs (Final Investigation Results by the Public-Private Joint Investigation Team). BPFDoor is remote-control malware designed to hide for a long time. The Ministry of Science and ICT described it as a stealthy backdoor that abuses network monitoring and filtering features built into Linux to make it difficult to detect the hacker's communications (First Investigation Announcement by the Ministry of Science and ICT).

On February 23, 2022, the servers rebooted abnormally. SKT inspected the servers and deleted the malware, but did not report the security incident as required by law. When checking suspicious login attempts on the HSS administration server, it looked at only 1 out of 6 log files and missed the attacker's access traces (Final Investigation Results by the Public-Private Joint Investigation Team). The investigation team noted that as a result, BPFDoor was not identified on the HSS, and since there was no report, the government could not find the malware through an investigation and take action (Final Investigation Results by the Public-Private Joint Investigation Team). The Personal Information Protection Commission described the same point as follows: even after SKT confirmed in February 2022 that hackers had accessed the HSS, it failed to inspect abnormal communications or additional malware, thereby missing the opportunity to prevent this leak in advance (Disposal Announcement by the Personal Information Protection Commission).

The attacker remained even after that. The investigation team estimated that in June 2022, the attacker expanded their foothold to the customer management network servers (Final Investigation Results by the Public-Private Joint Investigation Team). From November 30, 2023, to April 21, 2025, they periodically re-entered using an administrator password that had no expiration date and had not been changed for several years, newly planting and modifying malware (Final Investigation Results by the Public-Private Joint Investigation Team). And on April 18, 2025, they accessed 3 HSSs using that long-used account information, compressed 9.82 GB of USIM data, and exfiltrated it outside (Final Investigation Results by the Public-Private Joint Investigation Team).

The confirmed USIM data leak occurred on April 18, but even considering only the intrusions confirmed by the documents, they lasted from August 2021 to April 2025. In between, the response in February 2022 was noted as a problem by both agencies.

Ten Days Starting the Night of April 18

The time the breach was noticed varies by document. According to the investigation team, SKT detected an abnormally large external transfer at 11:20 PM on April 18 and reported it to the Korea Internet & Security Agency (KISA), which receives statutory reports, at 4:46 PM on April 20. The investigation team concluded that this exceeded the statutory reporting deadline of 24 hours (민관합동조사단 최종 조사 결과). The customer notice issued by SKT on April 22 is the company's explanation. It states that around 11:00 PM on April 19, they discovered circumstances suspected of leaking some USIM-related information due to malicious code, reported it "immediately" to relevant organizations including KISA, and immediately deleted the malicious code and isolated the suspected equipment. It also stated that no actual cases of misuse had yet been confirmed (SKT 고객 공지). The Personal Information Protection Commission (PIPC) stated that SKT learned of the personal information leak at 11:40 PM on April 19 and reported the leak to the PIPC on April 22 (개인정보위 처분 발표). The three documents differ in their criteria for what constitutes "noticing" the incident. One points to strange mass transmission, one to signs of a leak, and one to the personal information leak itself. "Immediately" is SKT's phrasing, whereas the investigation team viewed the same report as a violation of the deadline.

The investigation was not smooth from the start either. The Ministry of Science and ICT issued a data preservation order at 5:42 PM on April 21, but by 7:52 PM on the same day, SKT modified two servers into a state where forensic images for investigation could not be made. The investigation team stated that it would request an investigation into this (민관합동조사단 최종 조사 결과). The Ministry of Science and ICT formed the investigation team on April 23 (민관합동조사단 최종 조사 결과). The PIPC formed a joint intensive investigation task force with KISA on the very day it received the report on April 22, and investigators stayed on-site for about three months (개인정보위 처분 발표).

Measures for customers branched in two directions. On April 25 and 28, SKT announced that it would provide free USIM replacements to any customers who wanted them starting at 10:00 AM. This included eSIMs, which are USIMs built directly into devices, and was limited to one replacement per subscriber based on subscriptions as of midnight on April 18 (SKT 보도자료). The other measure was the USIM protection service. According to SKT's explanation, this is a service that prevents anyone from connecting to telecommunications under a customer's name from another device, even if the USIM information is stolen and cloned (SKT 대고객 발표문). Sign-ups surged, reaching 5.54 million people by 6:00 PM on April 27, while the USIM inventory disclosed by SKT on the same day was approximately 1 million units (SKT 대고객 발표문). SKT later announced on June 19 that it had replaced the USIMs for all approximately 9 million customers who had made reservations (SKT 「책임과 약속」 발표).

How Many Machines, How Many Kinds, How Many Records

As the investigation widened, the numbers changed. The first announcement on April 29 examined 5 servers showing signs of breach, confirmed the leakage of 4 kinds of customer information that could be used for USIM cloning, such as phone numbers and IMSIs, and found 4 variants of BPFDoor (과기정통부 1차 조사 발표). The second announcement on May 19 checked about 30,000 Linux servers four times (three of which were SKT's own checks verified by the investigation team), finding 23 infected servers and 25 types of malicious code, of which 8 were still under analysis (민관합동조사단 2차 발표). The final announcement on July 4 checked all 42,605 SKT servers, confirming 28 infected servers and 33 types of malicious code (민관합동조사단 최종 조사 결과).

The scale of the leak is measured in different units across documents. The second announcement noted that the leaked USIM data was 9.82GB and the IMSI records numbered 26,957,749 (민관합동조사단 2차 발표). The final announcement recorded it as 25 kinds of USIM data including IMSIs, 9.82GB, and about 26.96 million records (민관합동조사단 최종 조사 결과). The units up to this point are the number of records.

The Personal Information Protection Commission counted people. Based on mobile phone numbers and IMSIs, the count was about 26.96 million, but after excluding corporate and public lines and cases where one person had multiple lines, they recounted by users. Through this, they confirmed that 25 types of information, including mobile phone numbers, IMSIs, and USIM authentication keys, were leaked for 23,244,649 total LTE and 5G users, including budget phone subscribers (개인정보위 처분 발표). The unit for this number is people, with duplicates removed. The Personal Information Protection Commission also counted the authentication keys separately. SKT stored 26,144,363 USIM authentication keys unencrypted in plain text in HSS databases and elsewhere, and hackers got their hands on these exact original authentication keys, which could be used for USIM cloning (개인정보위 처분 발표). Plain text is the original content before applying encryption, readable by anyone, as covered in "Encryption — The Content Is Locked, but the Record of Comings and Goings Remains".

About 26.96 million records, 23,244,649 people, and 26,144,363 authentication keys are the numbers counted. The three cannot be used interchangeably.

Unique Device Numbers — From "None" to "Unknown"

If the IMSI points to the USIM, there is a separate number that points to the device. The International Mobile Equipment Identity (IMEI) is a number used to identify each individual mobile phone (과기정통부 1차 조사 발표). The English title of the first announcement on April 29 was "Confirmation of No IMEI Leak", and the main text also confirmed that unique device numbers were not leaked in this breach.

The second announcement on May 19 included both the basis for this and subsequent findings. In the first round, 38 servers known to store IMEIs were checked first to confirm they were not infected. However, subsequent analysis revealed that a file containing 291,831 IMEIs was temporarily stored on some of the infected servers linked to SKT's integrated customer authentication system (민관합동조사단 2차 발표).

The final announcement described the scope more precisely. On two of the infected servers, IMEIs were temporarily stored in plain text along with names, dates of birth, phone numbers, and email addresses, while call logs were temporarily stored on one server. For the period with firewall log records—specifically, from December 3, 2024, to April 24, 2025, for IMEIs, and from December 9, 2024, to April 20, 2025, for call logs—there were no traces of a leak. For the period without logs—specifically, from June 15, 2022, to December 2, 2024, for IMEIs, and from January 31, 2023, to December 8, 2024—it noted that a leak could not be ruled out (민관합동조사단 최종 조사 결과). There was a reason even the log retention was short. SKT's regulations required firewall logs to be kept for six months, but they were actually kept for only four months, which created limitations for the investigation team in tracking the leak (민관합동조사단 최종 조사 결과).

The language in the briefings also shifted in the same direction. At the second briefing in May, the Ministry of Science and ICT's Network Policy Officer stated the judgment that it is "physically" impossible to manufacture a cloned phone using just the 15-digit IMEI without the manufacturer-specific authentication keys held by the device makers, and that this had been confirmed with the manufacturers (2차 발표 브리핑). At the final briefing in July, while adding the caveat that manufacturers maintain their stance that it is impossible, the official answered that even if an IMEI is leaked, "it would be difficult to say that device cloning is 100% impossible" (최종 발표 브리핑).

"Confirmation of no leak" was the conclusion for the scope of servers checked at the time, and as the scope expanded, the periods without logs remained as periods that could not be verified.

The Causes Listed by the Two Authorities

Neither of SKT's two statements explained the causes separately. In his April 25 statement, SKT CEO Yoo Young-sang stated that the government investigation into the cause and scale of the incident was "now in its initial stages" (SKT CEO Statement), and on July 4, SKT announced that it would "accept the investigation team's findings seriously" (SKT "Responsibility and Promise" Statement).

The investigation team pointed to three fundamental causes: poor management of account information, inadequate response to the February 2022 breach, and insufficient encryption of major information (Final Investigation Results of the Joint Public-Private Investigation Team). Regarding account information, it cited that the server login IDs and passwords, including those for the HSS management server infected in December 2021, were stored in plaintext on another server (Final Investigation Results of the Joint Public-Private Investigation Team). Regarding encryption, it noted that storing USIM authentication keys in plaintext violated the recommendations of the GSMA (GSM Association) and the practices of KT and LG Uplus (Final Investigation Results of the Joint Public-Private Investigation Team). This means that encryption-at-rest—which is locking data stored on a server while it is being kept—was absent for these keys. The investigation team also pointed out the management structure. The Chief Information Security Officer was in charge only of the IT area (57% of assets), while the network area (43%) was managed separately. The information security personnel per 1 million subscribers was 15, and the investment amount including SK Broadband was 3.79 billion KRW, both of which were smaller than the telecommunications industry averages of 17.7 people and 5.74 billion KRW (Final Investigation Results of the Joint Public-Private Investigation Team).

The Personal Information Protection Commission concluded that this accident occurred due to SKT's "lack of basic security measures and negligence in management" (PIPC Disposition Announcement). It cited account information and encryption just as the investigation team did, and added items not found on the investigation team's list of causes. The first is the failure to separate networks. SKT operated by connecting the internet, management, core, and internal networks into the same network, while allowing unrestricted access from domestic and foreign internet sources to internal management network servers, and also permitted access to management network servers that had no need to be connected to the HSS (PIPC Disposition Announcement). The second is patches. As covered in "Security — Unseen by Others, Unchanged in Secret, Open When Needed", a patch is a revised version released to fix vulnerabilities in already released programs. The operating system vulnerability used to install the malicious code had its security alert and patch released in October 2016, but SKT installed the operating system with that vulnerability in November 2016 knowing about it, and did not update it until the leak in April 2025 (PIPC Disposition Announcement). The third is antivirus software. Commercial antivirus programs had been detecting the execution of that vulnerability since at least 2020, but SKT did not install them until April 2025 and neglected security measures that could have served as a substitute (PIPC Disposition Announcement).

The remainder of the items listed by the PIPC are of the same vein. A file containing account information for approximately 2,365 servers was kept on a management network server without a password set, and personal information could be queried in the HSS without any authentication procedures such as entering a password (PIPC Disposition Announcement). When USIM cloning issues appeared in the media around 2022, SKT reviewed encrypting authentication keys and confirmed that other telecommunications companies had already been encrypting and storing them for several years, yet took no action (PIPC Disposition Announcement). The role of the Chief Privacy Officer was limited to IT areas such as web and apps, so even the processing status of the infrastructure area where the accident occurred was not grasped (PIPC Disposition Announcement).

The two lists do not contradict each other. However, network separation, patches delayed since 2016, antivirus software, unauthenticated queries in the HSS, and the scope of the Chief Privacy Officer appear only on the PIPC side. Most of the causes cited by the two authorities had persisted for several years. The PIPC also judged that the violations had continued for over two years (PIPC Disposition Announcement).

What Can Be Done with Leaked Keys

SIM cloning—creating another SIM that answers like that SIM using an authentication key—is different from the SIM swap attack covered in "Passwords and Passkeys — How Do You Prove You Are You?". A SIM swap attack is when an attacker gets the telecom company to move a victim's phone number to a SIM the attacker holds. While a swap attack tricks the telecom company into moving the number, cloning copies the key to make an extra SIM for the same subscriber.

That key is normally guarded inside a chip. Two laboratory studies that extracted keys from inside chips had to hold the card in their hands and measure signals leaking while the chip calculated. In some implementations of 2nd Generation (GSM) SIM cards, this kind of measurement recovered the key (DOI: 10.1109/secpri.2002.1004360). In 3G/4G SIM cards from multiple telecom companies and manufacturers, power measurements also recovered the keys and secrets needed for cloning within minutes, and the authors concluded that physical security problems should be solved as a long-term task with proper countermeasures early in development (DOI: 10.1007/978-3-319-24174-6_24). There is also research showing how to clone wirelessly by exploiting weaknesses in GSM communications without getting the card in hand. This research noted that post-3G SIM cards are more resistant to cloning than GSM, but remain vulnerable under specific conditions (DOI: 10.1109/socialcom.2013.161).

This time, there was no need to touch the chip. Hackers got their hands on 26,144,363 authentication keys stored in plain text in HSS databases and elsewhere, exactly as they were in the original (Personal Information Protection Commission disposition announcement). The design protecting the key inside the chip was a defense against attacks targeting the chip, while copies of the same key sat in plain text in places like the HSS.

Leaking only the IMSI versus leaking the authentication key as well carry very different weights. In the 4G authentication procedure, the IMSI is a value sent back and forth without encryption to receive service, and its exposure can put the subscriber's privacy at risk and serve as a stepping stone for attacks targeting a specific subscriber (DOI: 10.1109/compsac.2016.108). The authentication key is the part kept secret by design. When you change your SIM, the telecom server also verifies with the new authentication key contained in the new SIM, so a cloned SIM made with the leaked old key no longer works.

The possibilities stated in the document are as follows. The Ministry of Science and ICT noted that if authentication keys are exposed, a third party could clone the SIM and, if there are no other protective measures, make phone calls or intercept incoming calls and texts using the subscriber's number (Public-Private Joint Investigation Team final investigation results). In the final briefing, the Ministry explained that this sentence was based on the assumption that there were no protective measures, and verbally mentioned that in an incident at another company in 2021, a SIM was cloned and inserted into another device while the customer was asleep to commit a crime. The company name was not disclosed (final presentation briefing). In the same briefing, the Ministry answered that additional investigations had not found any trace of damage caused by cloning (final presentation briefing). As of the second announcement, checks on other telecom companies, major platforms, and the public sector showed no reported damage in either the private or public sectors (Public-Private Joint Investigation Team second announcement).

The effectiveness of protective measures was described differently depending on the timing. On April 27, SKT stated that the SIM Protection Service has 「the same damage prevention effect as a SIM swap」 and that it would take 100% responsibility if damage occurred (SKT announcement to customers), and prior to that, stated that strengthening the Fraud Detection System (FDS), which blocks abnormal authentication attempts, had 「virtually the same effect as a SIM swap」 (SKT press release). The Ministry's first announcement also recommended signing up for a SIM swap or service, saying that the SIM Protection Service provides a similar preventive effect, and urged SKT to take 100% responsibility starting from the time of reservation (Ministry of Science and ICT first investigation announcement). The final announcement looked separately at the time of the leak. At that time, SKT had FDS 1.0 and the SIM Protection Service, but there were about 50,000 service subscribers and FDS 1.0 did not block all forms of SIM cloning. Based on this, the investigation team judged that SKT failed to fulfill its primary duty to protect SIM information and provide a safe service (Public-Private Joint Investigation Team final investigation results). In the final briefing, the Ministry answered that the FDS upgrade was completed on May 18 (final presentation briefing). The April reference to the 「same effect」 refers to the state after reinforcement and increased subscription following the accident, while the final judgment refers to the state at the time of the leak.

Late Notification and Penalties

Reporting and notification are distinct duties. Reporting goes to the government; notification goes to the victims. According to the investigation team, starting August 14, 2024, security incidents had to be reported within 24 hours, whereas previously they had to be reported "immediately." Two infected servers were not reported at all. The investigation team noted that missing this reporting deadline and failing to report these servers were subject to an administrative fine of up to 30 million won (민관합동조사단 최종 조사 결과).

Breach notification is what we covered in "The Equifax Breach — After the Theft of Data No One Chose to Hand Over", where a company whose personal data has leaked informs the owners of that data. The Personal Information Protection Commission determined that although SKT learned of the leak at 11:40 PM on April 19 and verified its scale around April 25, it failed to notify users within the statutory 72-hour limit. Although the Personal Information Protection Commission issued an emergency resolution on May 2 to notify users immediately, SKT notified them of the "possibility" of a leak on May 9 and only notified them of a "confirmed" leak on July 28 (개인정보위 처분 발표).

The penalties were announced on August 28. They consisted of a penalty surcharge of 134.791 billion won for violating safety measure obligations, and a 9.6 million won administrative fine for delayed notification. The Personal Information Protection Commission judged this to be a "very serious violation," increasing the penalty in part because the violation persisted for over two years, while partially reducing it in recognition of corrective actions and efforts to restore victim damage (개인정보위 처분 발표). Along with a corrective order requiring the company to reorganize its governance so that the Chief Privacy Officer oversees the entire company and to establish and report a recurrence prevention plan within three months, it also issued an improvement recommendation to obtain Information Security and Personal Information Protection Management System (ISMS-P) certification for the mobile communication networks and systems where the incident occurred (개인정보위 처분 발표). Applications for collective and individual dispute mediation had also been filed, and mediations that had been paused during the investigation were scheduled to resume after the penalties were issued (개인정보위 처분 발표).

The Ministry of Science and ICT approached the matter from a contract perspective. Finding SKT at fault and in breach of its primary contractual obligation to "provide secure communication services," the Ministry concluded that this constituted company culpability, which qualifies for a waiver of penalty fees under the terms of use. Four out of five legal advisory firms judged SKT to be at fault, while one reserved judgment due to insufficient data. The Ministry of Science and ICT stated that this judgment is limited to SKT and this specific accident, and does not serve as a precedent for all cyber incidents (민관합동조사단 최종 조사 결과). On the same day, SKT announced that it would waive penalty fees for contract customers as of 24:00 on April 18 who had canceled their service after the accident or would do so by July 14, unveiled a 500 billion won customer appreciation package including billing discounts, committed 700 billion won to information security investments over five years, and placed the Chief Information Security Officer directly under the CEO (SKT 「책임과 약속」 발표). The Ministry of Science and ICT required SKT to execute its implementation plan between August and October 2025 and undergo an on-site inspection between November and December (민관합동조사단 최종 조사 결과).

This penalty was issued under revised laws. One legal paper summarizes that the Personal Information Protection Act, fully revised in 2023, shifted breach penalties from a punishment-centered approach to an economic-sanction-centered one, and expanded the cap on penalty surcharges from "revenue related to the violation" to "3% of total revenue." Assessing the SKT incident as a typical case where penalty surcharges, administrative fines, corrective orders, and victim liability overlap, this paper suggested that while criminal punishment for violating safety measure obligations itself has become difficult, deterrence is being partially supplemented by economic sanctions and punitive damages. However, it concluded that strengthening penalty surcharges alone is not enough to prevent large-scale leaks, and that management and Chief Privacy Officer accountability, security personnel and budgets, encryption of core information, and prompt reporting must go hand in hand (DOI: 10.57057/lawreview.2026.3.26.1.253).

There is also research following up on the non-reporting incident from February 2022. An economic model study dealing with regulatory reporting duties assumes that companies have little incentive to self-report, and that audits cannot distinguish between what was concealed and what was unknown. It thus predicted that even under optimistic assumptions, it may be difficult to calibrate the level of sanctions so that reporting obligations yield social benefits (DOI: 10.1093/cybsec/tyw002). This is a theoretical model, not a study measuring this specific incident. There are also costs a company pays after a leak. Following unexpected corporate data leaks, reputational damage depressed stock and brand values while increasing customer churn, and companies repaired their reputations by increasing charitable donations and IT investments (DOI: 10.1093/rof/rfag009). In the leak responses of US publicly traded companies, compensation did not prove more effective than apologies, and the effectiveness of response strategies varied depending on the timing of the response (DOI: 10.25300/misq/2022/16609). Both studies measured other companies, and neither the documents nor the research reviewed in this article show what results SKT's penalty waivers and investment promises actually produced.

What We Still Do Not Know

A period remains with no logs. The investigation team noted that the leakage of IMEIs and call records from that period cannot be ruled out (민관합동조사단 최종 조사 결과).

The attacking side does not appear in the documents. No document identifies the attacking entity, and in the second briefing, the investigation team replied that the attacking entity is a matter for the police to track and intelligence agencies to investigate, so it is not appropriate for the investigation team to specify a particular entity (2차 발표 브리핑).

Regarding cloning damage, the final briefing's answer was that no clue could be found, but in the same briefing, the Ministry of Science and ICT also replied that it is difficult to guarantee 100% of the technical parts, so monitoring continues (최종 발표 브리핑). The results of the dispute mediation and the Ministry of Science and ICT's on-site inspections in November and December occurred after the documents examined in this article were released.

Where Was the Copy of the Key?

The key with which a mobile phone proves "I am this subscriber" existed in one copy inside a chip in the pocket and another on the telecom carrier's server, and what was opened this time was the server side. Among laboratory studies targeting the key inside the chip, two required holding the card in hand, while another showed the process of cloning it wirelessly. This time, there was no need to touch the chip. A copy on the server side was stored in plaintext in HSS and elsewhere. Regarding how that server was opened, the investigation team cited an unchanged administrator password, accounts and keys left in plaintext, and an unreported intrusion in 2022, to which the Personal Information Protection Commission added an unsegmented network and patches delayed since 2016.

The reason the Personal Information Protection Commission viewed this incident gravely also lay in the use of the key. In a society where mobile phones have become the core means of identity verification, information that forms the basis of that verification has leaked on a large scale (Personal Information Protection Commission disposition announcement). Why log-ins that receive by text a one-time code that no longer works once used or after a short time still lean on that number is in "Passwords and Passkeys — How Do You Prove You Are You?" and "The Limits of Two-Step Verification — Which Visitors Can Still Open the Second Door?", and the task of locking up data stored on a server is in "Encryption — The Content Is Locked, but the Record of Comings and Goings Remains".

Incident Materials

• "Notice Regarding Cyber Breach Incident" (2025-04-22) — https://www.sktelecom.com/notice/notice_detail.do?index=411 — SKT's initial customer notice as the involved party. Covers detection time, reporting, initial actions, and USIM protection service guidance (based on a saved copy as the main text did not load during a re-access in October 2026).
• "SKT Strengthens Customer Protection Measures to Relieve Anxiety Over Cyber Breach Incident… Includes Free USIM Replacement" (2025-04-25) — https://news.sktelecom.com/211563 — Press release by the involved party. Announces free USIM replacement, USIM protection service subscription numbers, and claims of enhanced FDS.
• "Full Text of Customer Information Protection Measures Announcement" (2025-04-25) — https://news.sktelecom.com/213019 — Presentation text from SKT CEO Yoo Young-sang's press briefing. Includes apologies and explanations of measures, while deferring the cause to a government investigation.
• "Customer Announcement" (2025-04-27) — https://news.sktelecom.com/211644 — The involved party. Claims the principles of the USIM protection service provide 「the same damage prevention effect as a USIM replacement」 and 「100% responsibility」, alongside USIM inventory status.
• "SKT Announces 'Responsibility and Promise' Program to Restore Customer Trust" (2025-07-04) — https://news.sktelecom.com/213571 — The involved party. Covers penalty waivers, customer appreciation packages, information protection investment plans, and current USIM replacement completion status.
• "MSIT Releases First Investigation Results on SKT Data Breach — No IMEI Leak Confirmed" (2025-04-29) — https://www.msit.go.kr/eng/bbs/view.do?nttSeqNo=1111&bbsSeqNo=42 — Ministry of Science and ICT (MSIT) 1st investigation announcement (English). Covers investigation of 5 servers, types of leaked information, BPFDoor explanation, and no IMEI leak.
• "Joint Public-Private Investigation Team Announces 2nd Results of SKT Breach Investigation" (2025-05-19) — https://www.msit.go.kr/bbs/view.do?sCode=user&nttSeqNo=3185809&bbsSeqNo=94&mId=307&mPid=208 (English version https://www.msit.go.kr/eng/bbs/view.do?nttSeqNo=1121&bbsSeqNo=42) — 23 infected servers, 25 types of malware, IMSI record count, discovery of temporary IMEI files, inspection of other operators.
• "Full Transcript of Briefing on Interim Investigation Results by Joint Public-Private Investigation Team into SKT Breach Incident" (2025-05-19) — https://www.korea.kr/briefing/policyBriefingView.do?newsId=156689741 — Q&A transcript (verbal) from the 2nd announcement. Answers regarding IMEI, cloned phones, and the attacking entity.
• "Announcement of Final Investigation Results for SK Telecom Breach Incident" (2025-07-04) — https://www.msit.go.kr/bbs/view.do?sCode=user&nttSeqNo=3185964&bbsSeqNo=94&mId=307&mPid=208 (English version https://www.msit.go.kr/eng/bbs/view.do?nttSeqNo=1139&bbsSeqNo=42) — Final results from the Joint Public-Private Investigation Team. Intrusion progress, 28 infected servers, 33 types of malware, 3 main causes, log gaps, judgment on penalty waivers, follow-up measures.
• "Full Transcript of Briefing on Announcement of Final Investigation Results for SK Telecom Breach Incident" (2025-07-04) — https://www.korea.kr/briefing/policyBriefingView.do?newsId=156721622 — Q&A transcript (verbal) from the final announcement. Meaning of the cloning assumption, clues to damage, possibility of IMEI cloning, advanced FDS.
• "PIPC Resolves on Disciplinary Actions for 'SK Telecom Personal Information Leak Incident'" (2025-08-28) — https://www.pipc.go.kr/np/cop/bbs/selectBoardArticle.do?bbsId=BS074&mCode=C020010000&nttId=11453 — PIPC investigation and disposition. Number of users, count of plaintext authentication keys, violations of network separation, patches, and antivirus, delayed notification, fines, penalties, corrective orders, and status of dispute mediation.

Source Papers

• "SafeSIM: SIM Card Authentication Framework Enhancement Using Zero-Knowledge Protocols and PUFs" (2026) — DOI: 10.1145/3822567 — Traditional SIM authentication relies on a fixed identifier (IMSI) and a shared secret (the authentication key Ki). Proposes a framework substituting them with zero-knowledge proofs and physically unclonable functions.
• "Partitioning attacks: or how to rapidly clone some GSM cards" (2005) — DOI: 10.1109/secpri.2002.1004360 — Recovers the 128-bit key via side-channel attacks (partitioning attacks) across multiple SIM card implementations of the GSM authentication algorithm COMP128. Proposes resource-efficient countermeasures.
• "Small Tweaks Do Not Help: Differential Power Analysis of MILENAGE Implementations in 3G/4G USIM Cards" (2015) — DOI: 10.1007/978-3-319-24174-6_24 — Recovers the key required for cloning within minutes using differential power analysis on 3G/4G USIMs from multiple carriers and manufacturers. Physical security remains a long-term challenge that must be addressed as a countermeasure early in development.
• "GSM OTA SIM Cloning Attack and Cloning Resistance in EAP-SIM and USIM" (2013) — DOI: 10.1109/socialcom.2013.161 — Demonstrates the requirements and process of over-the-air (OTA) SIM cloning exploiting weaknesses in GSM communications, comparing it with physical cloning. USIMs are more resistant to cloning than GSM but remain vulnerable under specific conditions.
• "Enhanced User Security and Privacy Protection in 4G LTE Network" (2016) — DOI: 10.1109/compsac.2016.108 — In 4G authentication procedures, the IMSI is transmitted in plaintext to receive service, and its exposure can lead to privacy risks and targeted subscriber attacks. Proposes a public-key-based enhancement.
• "A Study on Criminal Liability and Administrative Sanctions for Personal Information Breach -Focusing on the Revised Personal Information Protection Act and the SK Telecom Breach Case-" (2026) — DOI: 10.57057/lawreview.2026.3.26.1.253 — Legal analysis applying the economic-sanction-centered shift of the 2023 revised act and higher penalty caps to the SK Telecom breach case. Stating that stronger fines alone are insufficient, governance, encryption, and prompt reporting must go hand in hand.
• "The economics of mandatory security breach reporting to authorities" (2016) — DOI: 10.1093/cybsec/tyw002 — Principal-agent model. Because audits cannot distinguish between concealment and ignorance, mandatory reporting rules may make it difficult to calibrate penalty levels to produce a net social benefit.
• "Hacking corporate reputations" (2026) — DOI: 10.1093/rof/rfag009 — Unanticipated corporate breaches result in reputation loss that depresses stock and brand value while increasing customer churn. Firms recover their reputations through donations, corporate social responsibility, and IT investments.
• "An Empirical Investigation of Company Response to Data Breaches" (2022) — DOI: 10.25300/misq/2022/16609 — 204 corporate response letters, 811 surveys, and 166 event studies of US listed companies. Found that compensation was not more effective than apologies, the impact varied depending on the timing of the response, and negative effects dissipated after six months.