Gov’t launches joint investigation into unauthorized payments at KT

(Yonhap)

The South Korean government formed a joint public-private investigation team on Tuesday to determine the cause of unauthorized small payment incidents that affected KT Corp. subscribers in Gwangmyeong, Gyeonggi Province, and Geumcheon District, western Seoul.

The Ministry of Science and ICT announced that it launched an on-site investigation led by information protection network policy officer Choi Woo-hyuk.

The ministry and the Korea Internet & Security Agency (KISA) received a security breach report from KT at 7:16 p.m. on Monday and conducted an on-site inspection at KT’s headquarters in Umyeon-dong, southern Seoul, later that night.

Under the current Information and Communications Network Act, telecom operators must report any hacking or intrusion incident within 24 hours of discovery. KT reported the incident to KISA as required, and authorities immediately began data preservation and field investigations.

“We detected abnormal signs and filed a report,” a KT official said. “An investigation is underway, but there was no evidence of hacking into KT’s core telecom systems.”

The investigation team, made up of around 10 government officials, KISA staff, and private experts, will focus on identifying the cause of the small-payment fraud cases in Gwangmyeong and Geumcheon as well as on developing measures to prevent recurrence.

The probe does not, however, cover alleged Chinese hacker involvement or claims that KT discarded servers.

According to police, reported damages included 38 million won ($27,352) at Gwangmyeong Police Station and 7.8 million won at Geumcheon Police Station as of Monday.

Sosa Police Station in Bucheon, Gyeonggi Province, received an additional report of 4.11 million won in damages on Tuesday, and the cumulative reported damage has already exceeded 50 million won.

Victims said mobile gift certificates were purchased without their knowledge, and the South Gyeonggi Provincial Police are handling the merged investigation. Some victims reported that multiple unauthorized transactions occurred at dawn, including mobile gift certificate purchases and transit card top-ups, draining hundreds of thousands of won.

A budget phone subscriber in Incheon’s Bupyeong District who uses the KT network also claimed 275,000 won was siphoned off through small payments.

The Ministry of Science and ICT noted that the damage is concentrated in certain regions and unusually patterned, warranting close scrutiny.

“With the involvement of top domestic experts, the investigation team will quickly identify the cause and prevent further damage,” Vice Minister Ryu Je-myung said. “We will also cooperate closely with the police.”

KT also noted that it sincerely regrets the concern caused by this incident and will fully cooperate with government and police investigations to ensure the matter is resolved quickly.

Meanwhile, some speculate the unauthorized small payments may have been carried out using illegal “phantom base stations” created for hacking purposes.

According to the cybersecurity industry, KT reportedly detected suspicious traces while reviewing mobile network connection logs in the Gwangmyeong area.

“Call record analysis revealed a phantom base station that does not physically exist,” a security industry insider said. “It is possible the unauthorized payments were conducted via such a fake base station.”

The ministry said that it is reviewing the overall circumstances to determine whether phantom base stations were used in this case.