Home > Business > Industry

KT hacking incident expands to additional districts with rising victim count

Published: 21 Sep. 2025, 19:34

Two men, both Chinese nationals, step out of the Suwon Yeongtong Police Station on Sept. 18 to attend their pretrial detention hearings in Suwon, Gyeonggi. The two are suspected of hacking information from KT users using illegal base stations. [YONHAP]

The scope of damage from illegal micropayment linked to a KT hacking incident has expanded beyond the initially reported areas of Seoul’s Geumcheon District and Bucheon, Gyeonggi, to also include Seoul’s Seocho and Dongjak Districts, as well as Ilsandong District in Goyang, Gyeonggi. Police are focusing their investigation on higher-level figures suspected of directing the crimes.

According to data KT submitted to Democratic Party Rep. Hwang Jung-a on Sunday, cases of unauthorized micropayment charges were also identified in Seoul’s Dongjak, Seocho, Gwanak and Yeongdeungpo Districts as well as in Ilsandong District, Goyang. KT said the number of identified victims has risen from 278 to 362, and the estimated damage increased from 170 million won ($122,000) to 240 million won.

"The newly confirmed victims were identified through two additional illegal micro base stations, or femtocells, that were later found," said a KT official. "We have reported the matter to the Personal Information Protection Commission and other relevant authorities," adding that KT is reviewing the access records of more than 20,030 people who connected to the compromised femtocells.

As the number of victims grows, police are intensively questioning two suspects, including a 48-year-old Chinese national arrested on Thursday. Investigators secured testimony that the suspects received instructions from "higher-ups in China" and had met them there recently, prompting authorities to focus on tracking down the mastermind behind the crimes.

"We are investigating the higher-level figures to determine whether this was an organized crime," said a police official. "Efforts are also underway to secure the mastermind through various channels."

KT CEO Kim Young-shub bows his head in apology for the hacking incident of the telecommunications company during a press conference held in Jongno District, central Seoul, on Sept. 11. [JOINT PRESS CORPS]

The arrested suspects, both Chinese nationals, had been legally staying in Korea and working as day laborers. They had no professional background with KT or in information technology. They denied knowing each other and denied collusion, but police believe it is unlikely that they carried out the crime alone, given the technical expertise required, and instead suspect an organized scheme.

Police are investigating how the suspects coordinated the scheme, whether additional accomplices or organizations were involved, and are expected to hand the case over to prosecutors around Saturday. If the mastermind is confirmed to be overseas, authorities plan to request an Interpol Red Notice.

Authorities also seized the illegal femtocell equipment used in the crimes and are conducting a forensic analysis. They are checking whether newly identified victims in Seocho and other areas are linked to the suspects’ operations.

“We are reviewing the connection between the femtocells seized during the arrest and the two newly discovered femtocells, and may expand the investigation to cover them together,” said a police official.

This article was originally written in Korean and translated by a bilingual reporter with the help of generative AI tools. It was then edited by a native English-speaking editor. All AI-assisted translations are reviewed and refined by our newsroom.
BY KIM CHANG-YONG [[email protected]]