KT's W54b fine sparks fairness debate — 10 times Coupang's, despite no secondary harm

A 53.98 billion won ($37.5 million) fine imposed on KT Corp over a personal data breach has reignited a debate over the fairness of sanctions compared with those levied against Coupang Inc and SK Telecom. KT had more than 300 confirmed victims of secondary unauthorized micropayments, while no secondary harm has been proven in Coupang's case. Critics say the criteria for calculating fines remain opaque.

The Personal Information Protection Commission voted Thursday to impose a fine of 53.98 billion won on KT Corp, along with corrective orders, improvement recommendations and a public disclosure order. The commission found that KT had violated its obligation to implement adequate security measures, leading to a personal data breach and unauthorized micropayment damages stemming from the hacking of its femtocell base stations.

According to the commission, hackers infiltrated KT's internal network between October 2024 and November 2025, stealing the phone numbers, subscriber information and device identification numbers (IMEI) of 16,647 users, including those on mobile virtual network operators. The attackers also intercepted automated response system calls and text messages containing payment authentication codes, causing 368 victims a combined 240 million won in unauthorized micropayment charges. The commission found that KT had set a 10-year validity period for femtocell certificates and failed to restrict access by IP address, pointing to lax management.

Following the announcement, critics began questioning whether the penalty was too lenient compared with sanctions against Coupang Inc and SK Telecom, calling it discriminatory. Online communities picked up on claims of "discrimination against American companies" raised by the US administration and political circles, with posts saying, "This is exactly why the US is calling it discrimination."

Secondary harm accompanying a data breach — as seen in KT's case — has been rare among past incidents in Korea. Yet KT's fine amounted to just 8.6 percent of Coupang Inc's 624.7 billion won penalty and 40 percent of SK Telecom's 134.8 billion won fine. Even Coupang Inc's fine of 423.5 billion won, counting only the pure data-leak portion and excluding unauthorized data collection, stands as the largest of its kind in the country.

In Coupang Inc's case, a former employee of Chinese nationality was found to have leaked the personal data — names, email addresses, home addresses and phone numbers — of about 37.5 million people. However, a joint public-private investigation team found no evidence of secondary harm on the dark web or elsewhere, and the commission likewise found no proof of secondary damage. The same was true for SK Telecom, where the phone data and SIM card authentication keys of about 23.24 million subscribers were leaked.

The Center for Free Enterprise had previously commented that fines "should comprehensively consider the sensitivity of the leaked information, whether the violation was intentional or grossly negligent, whether actual or secondary harm occurred, when the incident was detected and reported, and post-incident response and recurrence-prevention efforts," arguing that proportionality and fairness must guide the level of sanctions.

Coupang Inc, the parent company of Coupang, has maintained that the sanctions are excessive given the absence of demonstrated secondary harm, saying "the actual information stored by the suspect amounted to only 3,000 records." The company plans to file an administrative lawsuit against the commission.

The commission explained its approach to the penalty levels, saying it calculated KT's fine based on wireless communications sales, then factored in the duration of the violation, the scale of harm and corrective measures taken. It said SK Telecom's breach was classified as a "very serious violation" given the type of data leaked and the scale of more than 23 million affected users, while KT's was rated a "serious violation."

The commission said KT's fine was based on its wireless business sales over the past three years — about 6.5 trillion won — with the fine rate at roughly 0.8 percent. SK Telecom was fined 134.8 billion won, equivalent to about 1 percent of its wireless sales at the time of the SIM card authentication key breach. Coupang Inc, assessed against sales of about 30 trillion won, faced a data-leak fine alone of 423.6 billion won, or about 1.4 percent of sales. Of the three companies, only KT had confirmed secondary harm, yet its fine rate was the lowest, as the scale of the breach was comparatively small.

Industry insiders have raised concerns that "even without concrete evidence of secondary harm, a large enough breach can trigger an astronomically large fine simply by being tied to sales figures." In the United States, secondary harm carries more weight than the scale of a data leak. More than 40 states — including New York, Texas and Illinois — have written into law the principle that data breach lawsuits cannot proceed without actual harm. Plaintiffs must demonstrate specific damages such as identity theft, financial fraud losses or credit restoration costs before they can seek compensation.

The United States, Taiwan, Japan, France and several other countries do not operate a revenue-linked fine system. Japan uses a fixed-penalty regime, imposing a maximum of 100 million won for personal data breach violations and up to 500,000 yen ($3,130) for false reporting or obstruction of investigations.

A cybersecurity industry official said that unlike the United States and other countries, which place heavy emphasis on whether secondary harm occurred and whether perpetrators actually obtained the data, South Korea counts even "access" or "viewing" as part of the leak volume even when there is no evidence the data left the organization. "There is ambiguity in the criteria for judging secondary harm, and the current system of pegging the value of personal data to sales figures needs to be reformed," the official said.