Ryu Young-sang, president of SK Telecom, repeatedly said that he is "reviewing" public opinion calling for waiving the penalties for users wishing to switch phone numbers due to the recent SK Telecom hacking incident. On the same day, he announced that the company would halt new sign-ups and number transfers at over 2,600 T World stores nationwide, while pushing for automatic enrollment of the universal subscriber identity module (USIM) protection service for all subscribers.
Ryu and the executives held a press briefing at 10 a.m. at the SK Telecom headquarters in Jung-gu, Seoul, where they revealed the aforementioned details. SK Telecom noted that the briefing was to address subscribers' anxieties and respond to false news caused by the hacking incident.
As the main speaker, Ryu Jeong-hwan, head of the Network Infrastructure Center (vice president), explained concerns regarding "financial fraud" among users. Additionally, Ryu, Vice President Ryu, Kim Hee-seob, head of the PR center, and Im Bong-ho, head of the MNO division, answered media questions during a Q&A session. SK Telecom plans to hold daily briefings on weekdays, excluding weekends and holidays.
Next is the Q&A session with SK Telecom executives.
-If the USIM information is stolen, won’t money be withdrawn from my account?
Vice President Ryu said, "No. The results of the joint investigation show that only USIM-related information has been leaked. Information on financial assets or other personal phone numbers or authentication details has not been compromised at all."
-If the USIM is copied, can all the texts or apps stored on my phone be copied as well?
Vice President Ryu stated, "No. While the USIM is physically one, it can be divided into two main parts. One part is a module linked to the network that performs authentication when making calls. The other is a memory space where other information is stored. The problematic part is related to the network. The physical memory space is not linked to the network at all. As long as the USIM itself is not stolen, there is no issue."
-Can a hacker secretly send texts or make calls using a copied phone?
Vice President Ryu said, "As long as the USIM protection service and the fraud detection system (FDS) solution that is blocking from the network are in place, it cannot be copied. Even if it were to be copied, two phones cannot register their locations simultaneously on the home subscriber server (HSS), so such incidents cannot occur."
-Even if I sign up for the USIM protection service, do I still need to change my USIM chip?
Vice President Ryu said, "I would say that it is not necessary to change. I think it is sufficiently safe with the FDS and USIM protection service; however, for users who feel anxious, I would advise them to change it."
-If the server has been hacked, wouldn’t it be useless to replace the USIM?
Vice President Ryu said, "Currently, the results of the joint public-private investigation indicate that the HSS has been compromised, but only information related to the USIM is stored there. There is no other information, so even if you change the USIM, there will be no damage."
-Even if I sign up for the USIM replacement notification service, do I need to take additional security measures with my banking apps?
Vice President Ryu said, "No, you don't have to. Even if the information necessary for authentication procedures is stored on the phone, it does not get saved on the USIM. We often say that we install the app. The issue is with that app. And there will likely be a need for authentication, which occurs through social network services (SNS) or certified certificates, so it's unrelated to USIM information."
-I received a notification text that my USIM has arrived from SK Telecom; should I go for the USIM replacement?
Vice President Ryu said, "SK Telecom has not sent such texts yet. Once we secure the stock of USIMs, we plan to send them sequentially, and the sender's number will be 114. Please make sure to check the sender's number when verifying the text."
-Is there a discussion regarding the waiving of penalties for customers switching phone numbers?
President Ryu said, "As I mentioned at the hearing, waiving penalties is a very complex issue. Therefore, both SK Telecom and the Ministry of Science and ICT are conducting various legal reviews through law firms. Once the legal review is complete, it will be adequately discussed in the board meeting."
Head Im stated, "The liability clause in the terms and conditions states that it applies in the event of a disruption accident in the communications financial service. However, it is a situation where various legal reviews are required regarding that part."
-If new sign-ups are halted, the biggest damage will be to the agencies. Have compensation measures been prepared?
President Ryu said, "We plan to implement measures in consultation with agencies. Looking at the structure of the distribution network, among the 2,600 T World stores, 350 are directly operated through subsidiaries, while the majority are agencies. Since they are also small businesses, asking them to stop engaging in new sign-ups could be a significant loss."
-Why has SK Telecom been less proactive in investing in information protection than other telecom companies?
President Ryu said, "Investments in information protection fundamentally include investments in personnel and equipment. SK Telecom has continually increased this over the past five years. Of course, it’s difficult to say it’s sufficient, but currently, combined with SK Broadband, it amounts to about 85 billion won. I know that KT invests more than us, and LG Uplus has increased investment after the incident two years ago."
Vice President Ryu mentioned, "The publicly available information includes the investment amount, but there is also the aspect of personnel. Looking at the personnel, we have the most, but the outsourcing rate is high. The technical capability for outsourcing and in-house work is the same. It seems that the investment amount appears lower due to the high level of outsourcing. However, regardless of all these factors, we will announce where the issues arose and how to improve them once the investigation results come out as a result of this incident."
-Are there any difficulties in the USIM supply process?
President Ryu said, "Due to physical limitations such as delivery, it is expected to be insufficient until May 14. I feel particularly sorry for the many roaming customers. However, we will ensure that there will be no disruptions in supply afterward. According to SK Telecom's standard, we usually prepare about 200,000 units a month, and approximately 400,000 based on market standards. The annual demand in South Korea is around 5 million units. Immediately after the incident, we ordered 5 million units and placed another order for 5 million in June, securing about 10 million units now. If needed, I plan to order more in July."
-Why is a courier service not provided? Is there a plan to provide transportation costs for subscribers who need to visit stores for USIM replacements?
President Ryu said, "Even if we receive packages, customers must go through the authentication process via the customer service center or our distribution network. We may consider it later, but for now, we aim to focus on the on-site distribution network. Moreover, many inquiries are coming to the customer service center, and if we start a courier operation, the customer service representatives would have to be deployed to the courier operations. We prioritize customers who come in. Although we haven’t considered transportation cost support, we will review it."
-SK Telecom claims that the USIM protection service is safe, but government agencies are recommending USIM replacements. Why is there such a difference in perception?
Vice President Ryu said, "Changing the USIM is a visible action, while the USIM protection service is merely a service being provided, which might lead to a difference in intuitive perception. When you sign up for the USIM protection service, unless this service is released, even as the subscriber, you cannot change devices. It has been set up to be that robust."
-Are new sign-ups at sales points also halted? It has been said that the Ministry of Science and ICT advised to stop new sign-ups at sales points.
President Ryu said, "We plan to discuss this before the implementation on the 5th. However, sales points do not have direct contracts with SK Telecom. Sales points are significantly smaller businesses than agencies. To ask them to stop their operations is almost the same as asking them to cease their business, which makes it very difficult. Therefore, we are responding by not being able to halt new sign-ups at sales points. The same goes for online sales, as we expect to be unable to restrict that as well."
-Is there any standard for the order of sending notification texts?
President Ryu said, "Initially, we tried to include a link to the USIM protection service in all texts and send them. However, we encountered capacity limitations. If we send texts to 3 million to 4 million people, 1 million to 2 million would apply for enrollment. Ultimately, after internal discussions, we decided to first send concise apology and announcement texts and gradually send out the service enrollment links to increase the volume of text messages sent."
Vice President Ryu said, "People have been asking why we did not send disaster messages; however, disaster messages are meant for the entire population, so we cannot utilize them. There are also character limits. The system for sending texts is separate between subscriber equipment and network equipment. The maximum number of texts we can send is between 4 million and 5 million, but initially, the subscriber equipment became overloaded, and we couldn’t send them all. We managed to increase capacity by disconnecting the network equipment from the subscriber equipment and sending texts solely through the network equipment."
-Are there any side effects like temporary value duplication issues with the upcoming USIM initialization service?
Vice President Ryu said, "I cannot share the specific logic, but we are preparing to ensure that no problems will occur."