KT's Cover-Up During Government Probe Exposed; Rep. Cho Kyoung-tae Urges Tough Administrative Action

Rep. Cho Kyoung-tae of the People Power Party, a member of the National Assembly’s Science, ICT, Broadcasting and Communications Committee representing Busan Saha District B, plans to aggressively question KT over allegations that it concealed a hacking incident and misled customers by promoting the message that it was 'safe' during a state audit of the Broadcast Media and Communications Commission on the 12th. Cho plans to press the allegations based on the fact that the government has confirmed signs of KT’s concealment of the hacking incident and obstruction of the investigation on 3 occasions.

According to the government’s findings, malware infections occurred on 38 servers in the network between March and July 2024, but KT did not report the incidents and deleted them on its own. Then, during a full investigation launched in April 2025 in the wake of the SKT personal information leak incident, it was found that logs from 10 compromised servers had been deleted. In August 2025, there was also a server suspected of compromise that was the subject of a tip-off to the overseas security magazine Phrack, but KT reportedly discarded that server several times and submitted false information about when it was discarded.

The government’s findings say these failures to report, self-deletion, log deletion, server disposal and false submission of disposal timing revealed signs of systematic obstruction of the government investigation. Cho plans to call for effective administrative sanctions, including a ban on recruiting new subscribers, if the fact-finding results confirm illegality.

The Ministry of Science and ICT and the Personal Information Protection Commission viewed the conduct in question as 'obstruction of the performance of official duties by deceptive means' and requested an investigation. The case is currently known to be under investigation by the Gyeonggi Nambu Provincial Police Agency.

Cho singled out the 2024 case, which the Broadcast Media and Communications Commission is investigating, as an example showing the seriousness of KT’s repeated concealment. At the time, KT’s chief privacy officer, or CPO, ordered the deletion of all logs from 38 infected servers. Personal information belonging to 23 employees was actually leaked from those infected servers.

Cho also pointed out that KT later denied the leak of customer information and continued to deny the hacking incident. An official from the Korea Internet & Security Agency, or KISA, who participated in the investigation said the deletion of log records deprived investigators of the chance to determine the exact scale of customer damage, and also warned of the possibility of a leak.

Cho also raised as a problem the fact that KT, despite suffering a hacking incident in 2024, had emphasized safe security to customers when another company was hit by a breach. KT’s chief information security officer, or CISO, publicly explained at a customer briefing on July 15 last year that malware such as web shells and BPFDoor, which had been found in a breach at another company, was not detected on its own servers. Cho described that public statement as deceiving customers, and the Broadcast Media and Communications Commission is conducting a fact-finding probe into the matter.

Rep. Cho Kyoung-tae said that with public interest in hacking rising amid a series of telecom breaches last year, if KT attracted customers by hiding the hacking incident and promoting the message that 'our company is safe,' that would distort users’ ability to choose.

Cho said he plans to ask at the National Assembly audit on the 12th whether KT’s safety promotion amounted to misleading users. He also said he plans to question the progress of the case, including when the fact-finding probe began, KT’s submitted materials and the schedule for reaching a conclusion, and whether effective sanctions such as a ban on recruiting new subscribers would be considered if company-level concealment of the hacking incident is confirmed.

He also said he plans to point out that the Ministry of Science and ICT and the Personal Information Protection Commission have already confirmed signs of repeated concealment and obstruction of the investigation, and that such signs should be reflected as key factors in the fact-finding probe. He added that although KT was administratively sanctioned last year over inadequate femtocell security management, concealment of the hacking incident and destruction of evidence are separate issues from the inadequate femtocell security management.

Cho urged the Broadcast Media and Communications Commission to conduct a thorough fact-finding probe. He also said that if KT’s illegality is confirmed, harsh sanctions such as business suspension are needed, and that strong penalties are necessary to prevent another concealment of a hacking incident and to raise social awareness.

Source: TECHWORLD · Lee Gwang-jae
Original: https://www.epnc.co.kr/news/articleView.html?idxno=407998

References

• https://www.epnc.co.kr/news/articleView.html?idxno=407998