KT Corp

From October 2024 to September 2025, attackers ran a homemade femtocell on KT's network with a valid certificate taken from a lost KT unit, intercepting phone numbers, IMSI and IMEI numbers, and SMS authentication codes. PIPC counts 16,647 subscribers exposed and 368 hit with fraudulent micropayments. The core network's perimeter was a certificate that outlived the hardware it was issued to. BPFDoor had sat on 38 KT servers since March 2024, unreported, and now KT has been accused of intentionally deleting logs and under reporting damages to the Korean government.