South Korea's Personal Information Protection Commission (PIPC) fined KT Corporation ₩53.979 billion (about $37.4–39 million) on July 30, 2026, for a data breach that exposed 16,647 subscribers' identifying information through a rogue femtocell. The regulator also filed a criminal complaint against KT for deleting server logs and giving investigators false statements during the probe.
Those are two different findings, and the distinction matters more than the headline number.
What actually happened
According to the PIPC's July 30 decision, a hacker extracted an authentication certificate from a discarded KT femtocell — the small indoor base stations telecoms use to boost signal in buildings — and embedded it in a self-built rogue device. Because KT issued identical, decade-long-valid certificates across roughly 240,000 femtocells without restricting connections by source IP or properly managing cell identifiers, the fake device connected to KT's internal network without additional authentication. Between October 8, 2024, and September 5, 2025 — eleven months — it intercepted phone numbers, IMSI and IMEI identifiers, and SMS authentication codes from nearby subscribers (Korea Herald; BleepingComputer). KT only noticed after customers reported fraudulent micropayments; 368 of them lost a combined ₩240 million (~$167,000) before the pattern was caught (BleepingComputer).
A government joint investigation team, coordinated with the Ministry of Science and ICT, had already found in late 2025 that KT's femtocell management was systemically inadequate — insufficient inspections, short log retention, no coherent protection program — and separately discovered 38–94 servers infected with BPFDoor malware in March 2024 that KT handled internally instead of reporting (Korea policy briefing). The PIPC's fine folds both failures together. Crucially, it also refers KT to prosecutors for deleting logs from those infected servers during its own April 2025 internal inspection and initially telling investigators no data existed — a claim digital forensics later contradicted.
The case for treating this as a serious sanction
Privacy advocates and Korean lawmakers have reasonable grounds to call this fine too small. ₩53.98 billion is roughly 0.2% of KT's annual revenue — nowhere near the maximum the Personal Information Protection Act theoretically allows, and dwarfed by the ₩624.9 billion ($409 million) PIPC levied on Coupang in June 2026 after a breach exposed over 30 million users (ComplianceHub). A telecom carrier is core national infrastructure; identical, decade-valid femtocell certificates across a quarter-million devices is not a subtle failure, and evidence destruction during a live investigation is the kind of institutional bad faith that should draw more than a fine. From September 11, 2026, Korea's amended PIPA raises the fine cap from 3% to 10% of total revenue for serious or repeat violations — a signal that regulators think today's ceiling is too low for exactly this kind of case.
Why the split penalty is the right model
But the KT decision, read carefully, is closer to proportionate than critics suggest — precisely because it separates the breach itself from the cover-up. Set against Coupang's 30-million-user exposure, KT's 16,647 affected subscribers and ₩240 million in fraud losses is a contained incident by comparison; a fine scaled to roughly 1% of KT's revenue (in the range of the Coupang penalty's 1.2% ratio to that company's turnover) would have been punitive well past the actual harm caused. Tying penalties to verified harm — number of records, financial loss, duration of exposure — rather than a flat percentage of revenue keeps enforcement calibrated to what happened rather than to how large the company happens to be.
What the PIPC did instead is arguably more useful: it kept the administrative fine anchored to the breach's real scope, and routed the genuinely aggravating conduct — log deletion, false statements to investigators — into a criminal referral, a track with its own evidentiary standard and its own consequences (Korea also referred LG Uplus separately for destroying evidence by discarding servers before its own investigation began). That's the correct incentive structure: a company that suffers a breach despite reasonable diligence should not face the same penalty as one that suffers a breach and then obstructs the inquiry into it. Blurring the two into a single, larger administrative fine would punish transparency and opacity identically, which is exactly the wrong signal to send to the next company deciding whether to preserve its logs or delete them.
The more consequential fight is the one arriving in six weeks. Once the 10% revenue cap takes effect, the PIPC will have room to impose Coupang-scale fines for KT-scale breaches — and whether it uses that room proportionately, or reaches for the ceiling because it can, is the real test of whether Korea's tightened privacy regime stays evidence-based or becomes punitive by default.