
In April 2025, South Korea’s leading telecommunications provider, SK Telecom, disclosed a major security incident. The company detected malicious software within its network, prompting the cybersecurity team to take immediate action by isolating the compromised servers.
The breach allowed attackers to steal a wide array of sensitive information, including users’ IMSI numbers, USIM authentication keys, network usage data, text messages, and contacts stored on SIM cards. To mitigate the risks associated with SIM-swapping attacks, SK Telecom announced it would issue replacement SIM cards to all affected customers, while also implementing stricter safeguards to prevent unauthorized number transfers.
On May 8, 2025, a joint investigative committee comprising the South Korean government and SK Telecom revealed that 25 separate backdoor programs had been discovered on the company’s servers. The scale of the intrusion far exceeded initial estimates, with investigators concluding that the attackers had maintained a covert presence within the infrastructure for as long as three years.
The committee conducted a comprehensive inspection of SK Telecom’s 30,000 Linux servers and traced the origin of the compromise to a web shell attack that began on June 15, 2022. Because SK Telecom failed to detect any anomalies for nearly three years, the intruders were able to implant a variety of backdoors tailored to different malicious functions as needed.
Alarmingly, SK Telecom only began logging server activity on December 31, 2024. As a result, there is a complete data void between June 15, 2022, and December 31, 2024, making it impossible to ascertain precisely what data was exfiltrated or what malicious operations may have been executed during that time.
According to the latest findings, the breach has affected a staggering 26.95 million SK Telecom users. In response, the company has suspended the onboarding of new customers and will begin notifying all affected individuals to replace their SIM cards and adopt enhanced security measures.