South Korea’s largest wireless carrier, SK Telecom, has launched emergency measures following a major data breach that exposed customer USIM card data. The cyberattack, detected on April 19, led to unauthorized access to sensitive SIM information, raising concerns about potential SIM swapping attacks and broader cybersecurity vulnerabilities.
Security Response and SIM Replacement Program
SK Telecom has begun offering free USIM card replacements at 2,600 carrier stores nationwide starting this week. However, due to supply constraints, only enough chips for less than five percent of its approximately 23 million customers are immediately available. The company plans to secure an additional five million chips by the end of May. To further address the shortage, SK Telecom will introduce a SIM card formatting system by mid-May, allowing customers to update the internal information on existing SIM cards without needing a physical replacement.
Eligibility for the free replacement program is limited to customers who were subscribed as of April 18, 2025. In addition, SK Telecom has enhanced its fraud detection systems and partnered with financial institutions to strengthen authentication protocols, at a time when industry-wide efforts to enhance secure credential exchange are gaining momentum. The company is also offering a free SIM protection service to prevent unauthorized SIM swaps, although enabling this service currently disables international roaming features, an issue SK Telecom has pledged to resolve.
Scope of Breach and Ongoing Investigations
While concerns about financial fraud and identity theft initially arose, the leaked data primarily included technical SIM information—such as IMSI, MSISDN, and authentication keys—rather than names, resident registration numbers, or direct financial records. This limits the immediate risk to SIM swapping attacks unless the stolen data is combined with information from other sources. As of the latest updates, there is no confirmed evidence of secondary damage or appearance of the data on the dark web.
Customer response has been swift and organized. Affected users have launched the “SKT USIM Hacking Joint Response” website to coordinate action, and a petition has been filed through the National Assembly’s public consent system demanding a full investigation and proper compensation. SK Telecom is cooperating with the Korea Internet Security Agency (KISA) and law enforcement, while authorities investigate possible links to state-sponsored actors or organized cybercriminal groups.
Government officials have strongly criticized SK Telecom’s response and transparency, and the company could face substantial penalties under South Korea’s Personal Information Protection Act. Approximately 9.7 gigabytes of data were exfiltrated during the breach, equivalent to roughly 2.7 million pages of documents.
While no ransomware group has claimed responsibility for the attack, the incident highlights the growing need for robust identity verification and fraud prevention technologies, especially as new integrated platforms gain traction across financial and mobile sectors.
Sources: Biz Chosun, Light Reading, Security Week
—
April 29, 2025 – by the ID Tech Editorial Team
