SKT, compensation plan for SIM card hacking - including fee reductions

Introduction - Shadows of the Communication Era

In modern society, communication is no longer a choice but an essential foundational infrastructure. We manage most aspects of our daily lives through smartphones and the internet, with telecommunication companies and data networks at the center. However, as technology progresses, its shadow deepens. This pertains to security issues. Communication networks are no longer just channels for transmitting voice and messages they are gateways through which our personal information and life data flow. If this gateway is breached, the consequences can be beyond imagination. The USIM hacking incident involving SK Telecom (hereinafter referred to as SKT), which began to surface in late 2024, was a significant event that revealed the fundamental vulnerabilities of a communication-based society. This incident prompted a review not only of technical flaws or temporary errors but also of the overall information security of the public, corporate responsibility structures, and even governmental response systems. In particular, the 'unprecedented compensation plan' that SKT put forward following this incident was highly unusual in both content and structure. Given that this incident is likely to serve as a case study not just in the telecommunications industry but across all sectors, it warrants a thorough examination.

Overview of the Incident – What is the SIM Card Hacking Incident

USIM hacking generally infiltrates personal information or communication functions through the USIM chip installed in the mobile phones of telecommunications subscribers. The recent SKT USIM hacking incident was particularly shocking due to the advanced social engineering techniques involved. It was not simply targeting specific individuals, but rather exploiting structural vulnerabilities in the distribution network and system to collect information from multiple customers and create pathways to manipulate or control some of it. SKT was unable to immediately clarify the method and pathway of the hacking, making it difficult to assess whether individual customers were affected. Consequently, in early 2025, the government formed a public-private joint investigation team led by the Ministry of Science and Technology, with the participation of the National Police Agency and the Korea Internet & Security Agency (KISA). The investigation team is examining various touchpoints, such as the USIM replacement process in the distribution network, the security status of the authentication system, and the call center response methods, analyzing how the hacking was possible. As the targets of the hacking were deemed to be an unspecified large number of people, simple victim verification methods were inadequate for resolving the issue, leading to increased public unease. Certain groups, such as the elderly, business travelers, and users of financial information linking services, faced heightened concerns about actual damages. With the speed of the incident's spread and its uncertainties, SKT began to consider rapid responses and compensation systems at the corporate level.

SKT's Response – Unprecedented Compensation Plan Development

SKT has maintained the stance of "doing our best to restore customer trust as a responsible company" since the early stages of the incident. However, under the internal judgment that simple apologies or post-measures would not alleviate concerns, SKT started preparing a compensation plan reflecting the interim report from the public-private joint investigation team. In this process, a structural and comprehensive compensation plan was prepared by incorporating external legal advice and the recommendations from the Customer Trust Committee. The core of the compensation plan is 'discounts on fees for all customers.' This is the first such case in the history of telecommunications companies, implementing basic compensation measures for all SKT subscribers without specifying target customers. With approximately 23 million SKT subscribers, even a simple discount of 10,000 won per person would amount to a total compensation of 230 billion won. When including support for additional services, the total compensation amount is estimated to reach several hundred billion won. This compensation plan consists of about 15 to 20 items, and specifically includes the following details. Firstly, the fee reduction for all customers forms the basic framework, and particularly, overseas travel customers who faced significant concerns will receive benefits from roaming fee discounts. Secondly, video call data support will be provided for the elderly and digitally vulnerable groups, and thirdly, additional T Membership points, free V coloring, and support for SIM card changes are also included. Notably, the waiver of penalties is under consideration for some customers, which is expected to be finalized in July after legal review. This comprehensive compensation plan holds significance beyond mere monetary compensation, as it also includes measures to restore customer trust as well as to improve the distribution network and internal security systems.

Structural Meaning – Why is it Exceptional

The main reason this compensation plan is drawing attention is due to its unprecedented approach and scope. Typically, when telecom companies offer discounts, it is in response to clear user inconvenience, such as network outages or service unavailability. However, SKT's compensation plan is highly unusual in that it applies the same level of compensation to all customers, even though specific victims are not identified and concrete damage has not been proven. This is not merely an act of avoiding responsibility, but is viewed as a proactive measure aimed at restoring trust from the perspective of corporate ethics. Particularly because telecommunication services are close to being public goods, there is a growing recognition that telecom companies must perform roles beyond just service providers when customers' data security is threatened. Furthermore, this compensation plan has a high potential to serve as a 'compensation standard' not only for the telecommunications industry but for all data-driven services in the future. It is expected that in industries reliant on data, such as finance, healthcare, and e-commerce, new social standards regarding the scope of corporate responsibility and compensation methods will emerge when incidents of personal information breaches or hacking occur. The political sphere is also hastening discussions around amending related legislation based on this incident. In particular, the National Assembly's Science, Technology, Information, Broadcasting and Communications Committee is set to address improvements to the penalty exemption system, obligatory security checks, and enhancements to the management system for SIM card issuance during the upcoming session in July. These institutional changes hold significant meaning not only for post-event responses but also for preventive measures.

Conclusion - Lessons Learned from the Incident

The SKT SIM card hacking incident signifies more than just a simple hacking event. It demonstrates how easily the communication infrastructure that governs customers' daily lives can be shaken, and how vast resources and efforts are required to reinforce it. In particular, SKT's provision of an unprecedented compensation plan is seen as a response that structurally reflects the company's social responsibility and commitment to customer protection, moving beyond a mere temporary measure. However, we must recognize that merely providing financial compensation does not resolve all issues arising from this incident. The more fundamental problems lie in the internal security systems of companies, certification procedures in distribution channels, and the shift in user protection awareness. Compensation is not an end but a beginning, and this challenge applies not only to SKT but to all telecommunications companies and related industries. Going forward, whether this compensation plan becomes the standard for similar incidents or whether more evolved responses will be developed remains a challenge for the entire industry and a matter of public interest. Ultimately, communication is not just a matter of technology but a matter of trust. The lesson left by this incident is that services should be centered around people, not technology. That may be the true significance of the large-scale compensation that SKT has endured.