Home > National > Social Affairs

Personal information watchdog fines SK Telecom $97 million over massive data leak

Published: 28 Aug. 2025, 11:36 Updated: 28 Aug. 2025, 19:18

SK Telecom store in Jungno District, central Seoul on July 3 [NEWS1]

The Personal Information Protection Commission imposed a record fine of 134.79 billion won ($97 million) on SK Telecom over a hacking incident in April that compromised the personal data of more than 23 million users.

The Personal Information Protection Commission (PIPC) said on Thursday that it decided in its 18th plenary meeting to levy the fine along with an additional 9.6 million won in penalties against SK Telecom. The regulator found that hackers accessed 25 categories of user data — including mobile phone numbers, subscriber identification numbers and USIM authentication keys — belonging to 23,244,649 LTE and 5G subscribers.

The watchdog also found SK Telecom failed to notify affected customers within 72 hours, as required by law. The delay, it said, worsened public confusion. That lapse levied an additional fine.

Until now, the largest fine imposed by the commission was 69.2 billion won on Google in 2022. Among telecom operators, the previous record was 6.8 billion won, against LG U+ in 2023.

PIPC Chairman Ko Hak-soo said the size of SK Telecom’s fine reflected both aggravating and mitigating factors.

“The company did not gain direct economic benefits, which reduced the penalty,” he said. “But it could have prevented the breach with stronger investment, which made the violation more serious.”

The fallout has already weighed on SK Telecom’s business. In the second quarter, the company’s revenue slipped 1.9 percent year-on-year, while operating profit plunged 37.1 percent. About 700,000 customers have left since the hacking incident. The fine has not yet been factored into SK Telecom’s financial statements. The company has already pledged a 500 billion won compensation program for affected users.

SK Telecom expressed regret over the commission's decision, saying Thursday it will review the details before issuing a formal response.

“We regret that our explanations and remedial efforts were not reflected in the outcome of the investigation and deliberation,” said the telecom giant in a statement. “We will carefully review the written decision once received and determine our position accordingly.”

“We take this result very seriously and will continue to prioritize personal data protection in all areas of management while doing our utmost to safeguard customer information,” added the company.

Update, Aug. 28: Updated article with quotes from PIPC on decision

BY KIM NAM-YOUNG [[email protected]]