Personal Information Commission Orders SKT to Promptly Notify Users of Hacking Incident

"Notice of Hacking Only Posted on Website... No Individual Notification Yet"
Individual Notifications Must Include Leaked Items, Circumstances, and Redress Procedures
Comprehensive Investigation of SKT's Individual Personal Information Management Systems Also Underway

The Personal Information Protection Commission has decided that SK Telecom must individually notify all users of the personal information leak incident involving SIM (USIM) cards and other data. The Commission is also conducting a comprehensive investigation into SKT's personal information management systems.

On the morning of May 2, the Commission held an emergency plenary session at 8:00 a.m. to review the circumstances of the incident and SKT's response thus far, and announced this decision.

On the 28th, customers waiting to replace their SIM cards visited an official SK Telecom certified agency in Mapo-gu, Seoul. SK Telecom plans to offer free SIM card replacement services to subscribers starting today. April 28, 2025. Photo by Kang Jinhyung

According to the Commission's findings, after SKT became aware of the circumstances suggesting customer SIM information had been leaked, the company reported the breach but only posted a general notice on its website stating that "some customer information is presumed to have been leaked." SKT did not individually notify data subjects of the leak, including the statutory details required under the Personal Information Protection Act.

After the incident, SKT sent a text message to all users, but the message only included an apology for the breach, information about the SIM protection service, and SIM replacement options. According to the Personal Information Protection Act, when notifying users of a personal information leak, the notification must include: ▲ the items of personal information leaked ▲ the time and circumstances of the leak ▲ methods to minimize damage ▲ the data controller's response measures and procedures for redress ▲ the department and contact information for reporting damage.

Accordingly, the Commission has decided that SKT must notify not only users whose information has been confirmed as leaked, but also all users whose information may have been compromised, including all legally required details. This also includes users of budget mobile services that utilize SKT's network.

Furthermore, the Commission explained that SKT's SIM protection service and SIM replacement measures, which were put in place to prevent further damage, have not been carried out smoothly due to shortages of SIM cards and delays in service processing. Under the Personal Information Protection Act, service providers are required to establish measures and take necessary actions to minimize damage from personal information leaks. In addition, since service registration or SIM replacement is only possible via mobile or in-person visits, there are accessibility issues for vulnerable groups such as the elderly and people with disabilities.

Therefore, the Commission has also instructed SKT to establish separate protection measures for vulnerable groups, including the elderly and people with disabilities, and to prepare support measures to prevent secondary damage to all SKT users. Considering the sharp increase in user complaints related to personal information, the Commission has decided to expand the dedicated response team and to operate it until the situation is fully resolved.

The Commission is conducting a comprehensive investigation into SKT's individual personal information management systems. A Commission official stated, "Through this full investigation, we will verify the exact circumstances of the leak and whether there have been any additional breaches, as well as focus on whether the company has fulfilled its legal obligations regarding safety measures. Any violations will be strictly sanctioned, and we will do our utmost to prevent recurrence."

The Commission has also ordered SKT to submit the results of its corrective actions within seven days and will continue to monitor the implementation of these measures. In addition, SKT will provide guidance to users on how to protect their personal information.