Article
Industries Cybercriminals Target and Why They Are Exposed
Cybercriminals target healthcare, finance, retail, government, manufacturing and energy. See why these industries are exposed and how to cut the risk.
Read more
Significant cyber incident
SK Telecom USIM data breach
In April 2025, South Korea's largest mobile carrier, SK Telecom, found that attackers had stolen USIM data from its core subscriber servers.
In short
In April 2025, South Korea's largest mobile carrier, SK Telecom, found that attackers had stolen USIM data from its core subscriber servers. The attackers had been inside the network since August 2021 and used stolen admin passwords and the BPFDoor backdoor. The ministry counted about 26.96 million IMSI records, and the privacy regulator fined the company KRW 134.79 billion in August 2025. The leaked data can help clone SIM cards.
What happened
SK Telecom detected unusually large outbound traffic late on 18 April 2025 and reported a significant breach to the Korean government agency KISA on 20 April. The Ministry of Science and ICT then opened an investigation with a public-private joint team.
The team scanned all 42,605 company servers. It found 28 infected servers and 33 malware strains. Attackers had taken 25 categories of USIM data, 9.82 GB in total, including about 26.96 million IMSI records. The ministry reported that no device identifiers (IMEI) were leaked in the period covered by logs.
The privacy regulator counted the people affected differently: about 23.24 million subscribers, with duplicates removed and budget carrier users included. The two numbers are not the same measure. Neither source names who was behind the attack.
Timeline
-
2021-08-06
An attacker gains access to an internet-facing management server and installs the CrossC2 backdoor (ministry reconstruction).
-
2021-12-24
The attacker logs in to the HSS management server with stored plain-text credentials and later implants BPFDoor on HSS nodes (24 December 2021 to 1 January 2022).
-
2022-02-23
An abnormal reboot leads SKT to remove malware. It does not file the required incident report and reviews only one of six log files.
-
2022-06
The attacker moves to the customer-management subnet and deploys a WebShell and more BPFDoor (15 and 22 June 2022).
-
2023-11-30
The attacker starts a period of repeated returns, installing and updating malware until 21 April 2025.
-
2025-04-18
SKT detects abnormal outbound traffic. The attacker has taken 9.82 GB of USIM data from three HSS nodes.
-
2025-04-20
SKT reports the breach to KISA, after the 24 hour legal window.
-
2025-04-23
The ministry forms a public-private joint investigation team.
-
2025-04-29
First results: four BPFDoor variants and no IMEI leak confirmed.
-
2025-05-02
The privacy regulator orders SKT to notify all subscribers with the legally required content.
-
2025-05-19
Second report: 23 infected servers found so far and 26,957,749 IMSI records leaked.
-
2025-07
The ministry publishes final results: 28 infected servers, 33 malware strains, negligence found. SKT announces its plan on 4 July.
-
2025-08-27
The privacy regulator decides to fine SKT KRW 134.79 billion.
-
2025-11-03
The dispute mediation committee finalizes a proposal of KRW 300,000 in damages per applicant.
How the attack worked
A long stay inside the network
The ministry says the attacker reached an internet-facing management server in August 2021 and installed the CrossC2 backdoor. That server held the IDs and passwords of other management hosts in unencrypted form. The ministry infers the attacker reused them to move to a second server.
Reaching the subscriber servers
The second server stored plain-text admin credentials for the HSS management server, which sits at the heart of mobile authentication. The attacker logged in on 24 December 2021 and implanted BPFDoor on the HSS and related nodes. The ministry calls BPFDoor a stealth backdoor that abuses the Berkeley Packet Filter, which makes the attacker’s traffic hard to see. The privacy regulator says the attackers exploited the DirtyCOW flaw (warned about in October 2016) to install BPFDoor.
In June 2022 the attacker moved to the customer-management subnet and placed a WebShell and more BPFDoor. The privacy regulator says SKT ran internet-facing, management, core and office networks without network isolation.
Staying in and taking the data
Admin passwords had no expiry and were not rotated for years. The attacker returned from November 2023 to April 2025 to add and update malware. On 18 April 2025 the attacker accessed three HSS nodes, compressed 9.82 GB of USIM data and sent it out through a server that still had outbound internet access.
Why the data matters
The stolen USIM data included IMSI numbers. The privacy regulator says it also included the Ki authentication key, stored without encryption. The ministry says leaked USIM data can enable SIM cloning and call or message interception.
Who says who was behind it
No public attribution. The Ministry of Science and ICT final results (July 2025) and the Personal Information Protection Commission decision (27 August 2025) describe "the attacker" and "hackers" and name no group or country.
Sources differ on size: the ministry counts about 26.96 million IMSI records, the privacy regulator counts about 23.24 million subscribers (deduplicated, including budget carrier users). The regulator's earlier statement of 2 May 2025 said around 25 million subscribers.
Impact
Data: 25 categories of USIM data, 9.82 GB, about 26.96 million IMSI records (ministry). The privacy regulator counts about 23.24 million subscribers, including phone numbers, USIM authentication keys (Ki, OPc) and IMSI.
IMEI: the ministry found no IMEI leak in the period covered by firewall logs. Files with 291,831 IMEI records sat on infected servers, and logs for 15 June 2022 to 2 December 2024 are missing, so leakage then cannot be ruled out.
Servers: 28 of 42,605 servers were infected with 33 malware strains.
Customers: SKT replaced SIMs for 9 million customers who had made reservations by 19 June 2025. On 2 May 2025 the privacy regulator said SIM replacement and USIM Protection were reachable only by app or in person, which was a barrier for elderly and disabled people.
Money: KRW 134.79 billion penalty, KRW 91 million fine and KRW 9.6 million for late notice (privacy regulator). SKT announced a KRW 700 billion five-year security plan and a KRW 500 billion customer package.
Customers can claim: the ministry ruled that affected subscribers can use the early-termination fee waiver. The mediation committee proposed KRW 300,000 per applicant, with 3,998 applicants.
Government and regulator response
- 20 to 21 April 2025: SKT reports to KISA. The ministry and KISA ask for evidence to be preserved and send experts. The ministry later says SKT altered two servers on 21 April, making forensic imaging impossible, and refers this for criminal investigation.
- 23 April 2025: a public-private joint investigation team is formed. It shares malware details with other firms and, on 12 May, a detection guide with 6,110 organizations.
- 28 April 2025: SKT starts free SIM replacement. The ministry urges customers to replace SIMs or enroll in USIM Protection.
- 2 May 2025: the privacy regulator orders SKT to notify all subscribers, with the content the law requires, and to help vulnerable users.
- July 2025: the ministry publishes final results, finds negligence and rules the early-termination fee waiver applies. It tells SKT to submit a plan, then audits on site in November and December 2025. On 4 July SKT acknowledges the findings, apologizes and announces its plan.
- 27 August 2025: the privacy regulator fines SKT and issues correction orders and a recommendation to extend ISMS-P certification to network systems.
- November 2025: the mediation committee finalizes a KRW 300,000 per applicant proposal.
Lessons
-
Stored passwords become the map
The attacker moved from server to server using IDs and passwords kept in plain text. Keep secrets in a vault and rotate admin passwords.
-
Old alerts need full follow-up
In February 2022 SKT removed malware but reviewed one of six log files and filed no report. The attacker stayed until 2025.
-
Separate your networks
The privacy regulator found internet-facing, management, core and office networks without isolation, so one foothold reached the subscriber servers.
-
Encrypt the crown jewels
The authentication key (Ki) sat in plain text on the HSS database, so one theft gave attackers usable SIM data.
-
Keep logs long enough
Firewall logs were kept four months, not six. Missing logs mean the ministry could not rule out earlier leakage of IMEI data.
-
Treat the deadline as part of defense
SKT reported late and did not notify subscribers in 72 hours. Both regulators counted this against it.
What to check in your own organization
-
Password storage
Search servers, scripts and wikis for stored admin IDs and passwords. Move them to a vault with multi-factor login.
-
Admin password age
List admin and service accounts whose passwords have not changed in a year. Set expiry and rotation.
-
Network separation
Check whether internet-facing, management, core and office networks can reach each other freely. Block server-to-server paths you do not need.
-
Encryption of key material
Confirm that authentication keys, tokens and subscriber secrets are encrypted at rest, as peers do.
-
Patches and antivirus on Linux
Check core Linux servers for old kernels and for endpoint detection. The regulator cited an unpatched 2016 flaw.
-
Incident follow-up
After any malware cleanup, review all log sources, not one, and test for other implanted hosts.
-
Log retention and reporting clocks
Keep firewall logs for at least your policy period. Test that you can report to the regulator in 24 hours and notify people in 72 hours.
Where it happened
- Country South Korea South Korea faces cyber espionage and destructive attacks linked by official sources to North Korean state groups, and large data breaches at telecom and retail firms. Asia Pacific
- Industry Telecommunications State-sponsored intrusions, subscriber data theft, SIM swapping and account takeover at telecom providers, and the rules that apply.
Questions
What happened to SK Telecom in 2025?
Attackers stole 9.82 GB of USIM data, including about 26.96 million IMSI records, from its subscriber servers. SKT detected the traffic on 18 April 2025 and reported it to KISA on 20 April.
How many people were affected?
Sources differ. The Ministry of Science and ICT counts about 26.96 million IMSI records. The privacy regulator counts about 23.24 million subscribers after removing duplicates.
Who was behind it?
No public attribution. Neither the ministry nor the privacy regulator names a group or country.
How long were the attackers inside?
The ministry reconstructs a first foothold on 6 August 2021 and activity until 21 April 2025, which is more than three years.
What was the fine?
On 27 August 2025 the privacy regulator decided on a KRW 134.79 billion penalty, a KRW 91 million fine and KRW 9.6 million for late notice to subscribers.
Were phone IMEI numbers leaked?
The ministry found no IMEI leak in the period covered by logs. Logs are missing for 15 June 2022 to 2 December 2024, so it cannot rule out leakage then.
In our research
- Industries Cybercriminals Target and Why They Are Exposed April 2025
- Telecommunications Industry
Sources
- MSIT Launches Prompt Investigation into SK Telecom Data Breach Ministry of Science and ICT, Republic of Korea
- MSIT Releases First Investigation Results on SKT Data Breach: No IMEI Leak Confirmed Ministry of Science and ICT, Republic of Korea
- Public-Private Joint Investigation Team Releases Second Report on SK Telecom Cybersecurity Breach Ministry of Science and ICT, Republic of Korea
- MSIT Releases Final Investigation Results on SK Telecom Data Breach Ministry of Science and ICT, Republic of Korea
- The PIPC Resolves its Deliberations on SKT to Inform Subscribers of Data Breach Immediately Personal Information Protection Commission, Republic of Korea
- The PIPC Sanctions SKT over Data Breach Personal Information Protection Commission, Republic of Korea
- The Personal Information Dispute Mediation Committee Holds Plenary Meeting to Initiate Collective Dispute Mediation Regarding SKT's Data Breach Personal Information Protection Commission, Republic of Korea
- The DMC Finalizes Mediation Proposal Against SKT to Award KRW 300,000 in Damages Personal Information Protection Commission, Republic of Korea
- SK Telecom Announces Accountability and Commitment Program SK Telecom
- BPFDoor, Software S1161 MITRE ATT&CK
- Web Shell, Technique T1505.003 (background on the WebShell used in June 2022) MITRE ATT&CK
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.