Both Parent and Subsidiary Stagger… This Time, Unauthorized Payment Incident at KT alpha

KT Corporation (KT) is reeling from a series of cyberattacks. Following incidents at KT, a data breach has now occurred at KT alpha, exposing personal information. Just three months after unauthorized micro-payments and server hacking incidents, another security vulnerability has come to light. As a result, KT is facing criticism for neglecting oversight and control of its subsidiaries, despite having opportunities for comprehensive investigations and preventive measures.

On the 26th, KT alpha announced that unauthorized gift certificate purchases had been made on its mobile gifting platform, Gifty Show. The company notified affected users individually and provided guidance to prevent further damage. The breach occurred between the 12th and 14th of this month, and the leaked information included the sender’s name and mobile phone number for mobile gift certificates.

A KT alpha representative explained, “It is believed that hackers used illegally obtained account credentials (IDs and passwords) from external sources to log in fraudulently and make unauthorized gift certificate purchases using registered credit cards. Although this was not a direct database (DB) leak through system hacking, we recommend changing your password.” If a card is registered for simple payment, transactions can be completed without additional identity verification.

Upon discovering the incident, KT alpha promptly reported it to relevant authorities, including the Korea Internet & Security Agency (KISA), Cyber Bureau, Korean National Police Agency, Personal Information Protection Commission (PIPC), and Financial Supervisory Service (FSS). The company also strengthened its Fraud Detection System (FDS), blocked logins for compromised accounts, and reset passwords. All unauthorized transactions have been canceled.

KT alpha urged users to be vigilant against secondary damages such as voice phishing or smishing, and recommended changing passwords to ones not used on other sites. For any questions or concerns regarding this incident, customers are advised to contact the KT alpha customer service center.

Within the IT industry, KT’s complacent response is being cited as the cause of this situation. In September, KT suffered from unauthorized micro-payment incidents involving illegal miniature base stations (Femtocell). Around 360 subscribers suffered financial losses totaling approximately 240 million won, and evidence was found that more than 22,000 subscribers connected to illegal Femtocells. It was an unprecedented event that threatened the national telecommunications infrastructure.

KT conducted a comprehensive investigation of all Femtocells and servers. Critics argue that if KT had extended this investigation to all subsidiaries, the risks could have been detected earlier. KT alpha’s passive response has also come under scrutiny. Although victims left inquiries about unauthorized payment attempts in the application’s customer center, the center merely cited system errors and processed refunds.

This article has been translated by GripLabs Mingo AI.