[Summary2] "Everything Stopped" KT Outage Causes Widespread Damage... Premature DDoS Mention

On the morning of the 25th, KT's internet network experienced an outage nationwide for over an hour, causing a sign that reads "Card payment unavailable due to network error" to be posted at the entrance of a restaurant in Masan-myeon, Gurye-gun, Jeollanam-do.
[Photo by Yonhap News]

[Asia Economy Reporters Seol Gina, Cha Minyoung, Koo Eunmo] "Of all times, this chaos happened just before lunchtime, the busiest time. The delivery apps weren't working, card payments failed, and there was no guidance on what to do." "While attending a Zoom lecture, the professor and classmates suddenly disappeared." "Even phone calls were down, which was truly shocking."

From around 11:20 a.m. on the 25th, KT's nationwide wired and wireless internet networks were paralyzed, causing numerous reports of damage across the country. KT initially hastily attributed the outage to a 'large-scale DDoS attack,' but corrected this to a 'routing (network path configuration) error' just over two hours later. Service disruptions began to recover around noon after about 30 to 40 minutes, but instability persisted thereafter.

◆ "Payments Fail, Securities Trading Systems Halt" Widespread Damage Reported

KT subscribers nationwide experienced inconvenience using various internet-based services. Not only did companies and schools using business networks suffer paralysis, but restaurants and shops using KT networks before lunchtime faced payment system and QR authentication failures, causing many citizens to express frustration.

Park, who runs a restaurant near Dangsan Station, said, "The outage happened at the busiest time when orders peak," adding, "There was no information on what the problem was or when it would be fixed, which was very frustrating." He added, "The number of orders during lunchtime was only about one-tenth of usual," and "Since card payments failed, we barely managed with bank transfers and cash."

Confusion was also observed as QR authentication required for restaurant entry failed, causing lines to form on the street. Some restaurants without prepared handwritten visitor logs hastily provided sheets for customers to write down their contact information. Even calls for entry registration were not smooth. Jeong, a KT wireless subscriber living near Sungshin Women's University, said, "I tried calling several times, but only received a message saying 'Service not available in this area.'"

Office workers essentially stopped working and headed early to restaurants for lunch. Clinics and pharmacies also faced difficulties accessing medical and payment systems. Bae, who runs a shopping mall, said, "I chose KT because it was the most stable and cheapest package, but this is frustrating," adding, "As an internet-based business, there was nothing I could do without internet."

On the internet, many voices expressed dissatisfaction over KT's outage. Especially stock traders, for whom transactions by the second or minute are critical, complained, saying, "It became a forced holiday," "A perfect time for manipulation," and "I was supposed to sell just now but couldn't." Korea Investment & Securities posted a notice on their app stating, "Due to KT internet connection issues, customers using KT as their telecom provider may experience access problems."

This outage highlighted how heavily our society depends on the internet. The impact was particularly significant given the widespread remote work and online classes due to COVID-19. A university student posted online, "During a Zoom class, the professor and classmates disappeared simultaneously," adding, "All are KT subscribers."

◆ "They Said DDoS" Premature Initial Response Also Criticized...Possibility of Human Error

KT's premature response blaming a 'DDoS attack' immediately after the incident also came under scrutiny. It caused unnecessary confusion and damaged KT's reputation as a provider of DDoS mitigation services.

KT initially suspected a 'large-scale DDoS attack' as the cause of the wired and wireless internet network paralysis. However, around 2:30 p.m., just over two hours later, KT issued an official statement correcting this, saying, "Initially, traffic overload led us to suspect a DDoS attack, but after careful examination, we identified a routing (network path configuration) error as the cause."

Routing refers to selecting the optimal path for transmitting communication data within a network. Telecom companies use this to efficiently manage large-scale traffic and ensure smooth internet network operation. KT has yet to disclose the specific circumstances that caused the routing error.

However, since KT mentioned 'traffic overload' as the reason for initially suspecting a DDoS attack, industry insiders speculate that incorrect routing configuration may have caused traffic to concentrate on a specific network. Symptoms caused by misconfigured routing can resemble those of a DDoS attack. Typically, routing tasks are handled by automated equipment based on pre-set values according to manuals. It remains unclear whether this incident was due to equipment failure, administrator configuration error, or occurred during device replacement or inspection.

Ultimately, this incident is being analyzed as a preventable 'human error.' KT's second labor union, KT Saenozu, issued a statement titled 'KT Nationwide Internet Paralysis Incident, a Serious Matter for Management to Take Responsibility,' saying, "If it is a routing error, there is a high possibility of human error, according to internal staff," and criticized, "It is the current reality of KT, a century-old telecom company, that nationwide internet communication is paralyzed due to human error." KT Saenozu added, "As workers of a national telecom company responsible for critical infrastructure, we feel deep shame and believe the cause and management responsibility must be clearly identified."

The Ministry of Science and ICT, the supervising authority, issued an information and communication accident crisis alert at the 'caution' level at 11:56 a.m. according to crisis management manuals and is investigating the specific cause. A ministry official said, "We instructed KT to investigate user damage status and plan to prepare follow-up measures such as recurrence prevention after investigating the cause."

◆ First Major Outage in 3 Years Since KT Ahyeon Branch Fire, How Will Compensation Be Determined?

KT experienced a large-scale network outage again after three years since the KT Ahyeon branch fire in 2018. While the previous damage was limited to certain areas, this time the disruption occurred nationwide, suggesting that the scale of damage and compensation could be larger. However, it is expected to be difficult for users to clearly prove the damages they suffered, making actual compensation challenging.

According to KT's terms of service, the company must compensate customers subscribing to mobile phone, high-speed internet, IPTV, and other services if they cannot receive service for more than three consecutive hours without their own fault. However, this incident lasted about 1 hour and 25 minutes. It is also difficult to prove causality for damages suffered by self-employed individuals due to internet outages.

KT stipulates that if 5G mobile customers cannot use the service for more than three consecutive hours due to reasons beyond their control, compensation will be negotiated based on an amount equivalent to eight times the monthly fee and additional usage charges. For high-speed internet, if service is unavailable for more than three consecutive hours or accumulates over six hours in a month, compensation is based on six times the amount corresponding to the service downtime.

For IPTV, if service is unavailable continuously for more than three hours or accumulates over 12 hours in a month, compensation is calculated by multiplying the hourly average amount (monthly fee divided by 24) by the downtime hours, then tripled and negotiated with the user. However, compensation is not provided if damages result from force majeure such as war, disasters, or the user's intentional or negligent actions.

◆ KT's Embarrassment... Network Outage Just After Koo Hyunmo's 'AI Era' Declaration

Notably, the nationwide wired and wireless internet outage occurred on the same morning that KT CEO Koo Hyunmo introduced KT's artificial intelligence (AI) business strategy and declared "AI for everyone's daily life."

KT held an online press conference starting at 10 a.m. that day to introduce plans to expand AI Contact Center (AICC) services applying AI active composite technology. Early in the conference, CEO Koo appeared in a video, stating, "AICC services such as AI customer centers and AI call assistants, based on 'AI active composite dialogue' technology, will be a turning point changing the paradigm of the AI industry," emphasizing, "We will create a daily life where AI responds 24/7, 365 days a year."

He also repeatedly emphasized that "KT has sufficient data through telecommunications and platforms and has solidified AI technology capabilities through significant investments," highlighting KT's potential to become a leading AI powerhouse in Korea based on telecom and platform infrastructure capabilities.

However, shortly after the conference ended, KT's wired and wireless internet networks nationwide experienced outages, causing KT to lose face. Before declaring itself an AI leader and digital platform company, KT's fundamental network operation and maintenance, which it has long prided itself on, was shaken, inviting criticism.