KT’s slow response to a new form of hacking exposes Korea’s institutional complacency

South Korea’s telecom companies have long boasted of running the world’s fastest, most sophisticated mobile networks. That distinction now carries a paradoxical risk: The density and ubiquity of the system have turned it into a hacker’s playground.

The latest breach at KT, the country’s second-largest mobile carrier, underscores the fragility of digital security in a hyper-connected society. It also exposes a startling new vector of cybercrime. What corrodes public trust most, however, is the company’s response.

Hackers appear to have deployed “ghost base stations,” miniature transmitters that mimic legitimate towers, hijacking user data to authorize fraudulent payments. Once largely the province of state intelligence agencies, the method has now trickled down into ordinary financial crime. As of Wednesday, KT acknowledged 278 victims and losses of about 177 million won ($127,200), concentrated in Gwangmyeong and Bucheon in Gyeonggi Province.

Equally troubling is KT’s handling of the case. Police flagged the first suspicious transaction on Aug. 27, yet the company insisted its network was secure and dismissed the warnings as improbable. Only on Saturday did KT quietly post a notice online, leaving customers exposed for more than a week — a digital equivalent of leaving the vault open and hoping no one notices.

Such delay is more than a public-relations misstep; it reflects a culture where safeguarding corporate reputation outweighs protecting customers. In a country where mobile carriers function as the gatekeepers of banking, shopping and even public services, such behavior is indefensible.

The failure is not KT’s alone. South Korea has endured a string of high-profile cyberattacks this year: a massive data leak at SK Telecom in April, followed by breaches at Yes24, SGI Seoul Guarantee and Lotte Card. Each incident has been treated as isolated, with government and corporations alike offering piecemeal, reactive fixes — a patchwork approach to a systemic problem.

The Ministry of Science and ICT has merely asked carriers to inspect for illegal base stations but has yet to outline a systemic, long-term defense. Similarly, the Personal Information Protection Commission’s plan to penalize repeat offenders and push for “punitive damages” is welcome but belated. It does little to address the structural vulnerabilities that make such breaches almost inevitable.

The deeper issue is a failure to anticipate evolving threats. Policymakers and firms still assume cyberattacks are primarily technical problems solvable with firewalls, software patches and consumer vigilance. Yet the KT case demonstrates that the danger has migrated from the digital into the physical realm. The next wave, powered by generative AI, miniaturized hardware and automation, will be faster, more sophisticated and far harder to detect — a threat with its own shadow network.

What, then, should be done? Government must move beyond perfunctory post-mortems to a binding framework that compels rapid disclosure, enforces two-step verification for mobile payments and equips law enforcement with the tools to detect rogue transmitters before they proliferate.

Companies must treat security not as overhead but as core infrastructure and a strategic imperative. That means deploying AI-powered anomaly detection, reinforcing defenses and training staff to recognize emerging threats. Above all, transparency must replace denial: Timely alerts are the only way to corral damage before it spreads.

The breach at KT, though modest in financial terms, exposes an enemy that is invisible yet embedded in the very fabric of infrastructure. South Korea’s telecom firms built a society where the smartphone became a wallet, ID card and key. That integration now magnifies the fallout when trust fractures.

The digital age, with all its conveniences, demands relentless vigilance. Until the government mandates proactive defenses and companies embrace transparency and sustained investment, Korean citizens will remain, in essence, digitally unprotected — vulnerable to the next unseen threat lurking just around the corner.


khnews@heraldcorp.com