It has been revealed that SK Telecom first recognized the fact of data movement a day earlier than the previously announced date of the 19th, indicating a violation of regulations requiring reporting to authorities within 24 hours of incident recognition.
According to materials submitted by SK Telecom to Representative Choi Soo-jin of the People Power Party on the 24th, the company first recognized at 6:09 p.m. on the 18th that data from the internal system had unintentionally moved.
Later that same day at 11:20 p.m., the company internally confirmed the discovery of malware and a hacking attack, and began analyzing what data had been compromised at 1:40 a.m. on the 19th.
After analyzing what type of data had been compromised, SK Telecom confirmed the circumstances of user SIM card-related information being leaked by cybercriminals around 11:40 p.m. on the same day, 22 hours later.
The reporting time of SK Telecom to the Korea Internet & Security Agency (KISA), as reported to Representative Choi's office, was at 4:46 p.m. on the 20th, which shows a 45-hour difference from the initial recognition time of 6 p.m. on the 18th. Even considering the 11 p.m. time on the 18th when the hacking attack was determined, it appears that the report was made more than a full day later.
The Act on the Promotion of Information and Communications Network Utilization and Information Protection requires service providers to report to the Minister of Science and ICT or KISA within 24 hours of becoming aware of any breaches, including the time of occurrence, causes, and extent of damage.
According to Representative Choi's office, KISA also stated that SK Telecom violated the regulation requiring hacking attacks to be reported within 24 hours.
Representative Choi noted, "Consumer concerns are growing following the hacking incident at SK Telecom. We will establish measures at the parliamentary level to prevent the spread of damage caused by such breaches and to prevent recurrence."
An SK Telecom official stated, "The reason for not reporting to KISA within 24 hours after the incident was assessed was that, considering the severity of the matter, a more thorough investigation into the minimum causes of occurrence and extent of damage required was necessary." He added, "There was no intention of deliberate delay at all."