The Personal Information Protection Commission said Thursday it had imposed the penalty at a plenary session the previous day, alongside corrective orders and a public disclosure order, and would separately file a criminal complaint against the carrier for deleting logs and giving false statements that obstructed the probe.
Hackers extracted certificates from a lost KT femtocell and planted them in illicit devices to slip onto the carrier's mobile network, intercepting traffic that passed between users' handsets and the internal system, investigators found.
They then combined the stolen data with names and birth dates to hijack payment verification texts and complete fraudulent purchases.
The breach exposed the phone numbers and device identifiers of 16,647 subscribers, including budget-carrier users, while 368 people suffered about 240 million won in unauthorized charges, the commission said.
KT had set the femtocell certificates to remain valid for a decade and imposed no restrictions on connecting IP addresses, allowing access through rival carriers or overseas networks, according to the regulator.
It also failed to detect unauthorized connections, leaving hackers free to roam its internal network for roughly 11 months.
"This security breach is an extremely critical matter directly tied to public trust in telecommunications services that are part of our daily lives," Minister of Science and ICT Bae Kyung-hoon said when the scheme first surfaced last year.
The commission also referred rival LG Uplus to prosecutors for obstruction, saying the carrier had reinstalled operating systems and scrapped servers before the inquiry began, and vowed to tighten the law so firms that destroy evidence before a probe can face criminal charges or fines of up to 3 percent of total revenue.
Copyright ⓒ Aju Press All rights reserved.