Millions of SK Telecom customers are under potential threat due to USIM data breach
April 22, 2025
SK Telecom cautioned about unauthorized access by perpetrators to customer USIM data via a malware intrusion.
SK Telecom acts as the largest cellular provider in South Korea and plays a significant role in the mobile and technological sector of the nation.
With a market share of approximately 48% in mobile services, approximately 34 million subscribers rely on their network. The corporation provides mobile services, 5D innovation, artificial intelligence advancements, IoT solutions, cloud computing, and smart urban infrastructure.
It operates under the SK Group, a massive conglomerate in South Korea that is active in sectors such as energy, semiconductors, chemicals, and more.
Following a malware breach, SK Telecom confirmed the infiltration of customer USIM data by malicious actors. The Universal Subscriber Identity Module (USIM) is a secure smart card utilized in mobile gadgets to store vital subscriber details, including the International Mobile Subscriber Identity (IMSI) and cryptographic codes.
The telecommunications giant identified an intrusion into its systems at 11 PM on Saturday, April 19, 2025. After detecting the breach, the organization swiftly notified the Korea Internet & Security Agency (KISA) on Sunday, April 20. They immediately disinfected the impacted systems, isolated the suspected hacking apparatus, and as of now, no instances of data misuse have been confirmed.
SK Telecom announced the implementation of enhanced defensive measures to prevent unauthorized SIM card modifications and irregular authentication attempts.
Furthermore, they extended a complimentary subscription of the ‘SIM protection service’ to affected customers.
“On April 19, 2025, around 11:00 PM, SK Telecom identified a potential leakage of SIM-related customer information due to malware,” as outlined in the data breach alert disclosed by the company. “After acknowledging the breach, SK Telecom immediately eliminated the malware, isolated the suspected hacking apparatus, and as of now, no actual abuses of the data have been confirmed. However, to safeguard our customers, we are executing the outlined countermeasures.”
Investigations are underway to identify the root of the security breach, evaluate the scale of the incident, and ascertain the extent of leaked data. Additionally, the South Korean provider reported the incident to the Personal Information Protection Commission on Tuesday, April 22, at 10:00 AM.
Individuals desiring additional security precautions could enroll in the SIM protection service.
Follow me on Twitter: @securityaffairs, Facebook, and Mastodon.
(SecurityAffairs – hacking, data breach)
About Author
