KT Corporation experienced a prolonged internal network compromise from October 2024 to September 2025, initiated by attackers exploiting a lost femtocell device with a valid authentication certificate. This allowed the attackers to impersonate legitimate network components and intercept cellular traffic, including mobile phone numbers, IMSI, IMEI, and authentication codes used for micro-payments. The breach exposed personal information of 16,647 subscribers and enabled fraudulent transactions totaling approximately $167,400. Concurrently, KT's IT service network was infected with BPFDoor malware, a stealthy backdoor linked to the Red Menshen espionage group, which evaded detection since March 2024. KT was aware of the malware but did not report it and deleted logs during internal investigations, obstructing a full forensic analysis. The PIPC fined KT and ordered improvements in femtocell security, personal information governance, and certification scope. The incident highlights critical security control failures and inadequate incident response.

The breach exposed personal information of 16,647 KT subscribers and resulted in fraudulent mobile payments totaling KRW 240 million ($167,400) affecting at least 368 customers. The attackers intercepted sensitive cellular data including phone numbers, IMSI, IMEI, and authentication codes, compromising subscriber privacy and financial security. The presence of BPFDoor malware on KT's IT service network indicates a sophisticated, persistent threat actor with espionage capabilities. KT's failure to report the malware and deletion of logs impeded investigation and risk assessment, potentially allowing further undetected data exfiltration. The incident undermines customer trust and regulatory compliance, leading to a significant financial penalty and mandated security reforms.

The Personal Information Protection Commission (PIPC) has ordered KT Corporation to strengthen security controls for femtocells and telecommunications equipment, enhance governance over personal information protection, ensure active oversight by the Chief Privacy Officer, and expand ISMS-P certification to cover mobile network systems. KT should implement stricter certificate management policies, including shorter validity periods and source IP restrictions, and close network routes that bypass management servers. The company must improve incident reporting transparency and avoid evidence destruction to comply with regulatory requirements. Organizations should monitor legislative developments for stronger penalties related to evidence concealment and adjust compliance programs accordingly.