SK Group Chairman Chey Tae-won Issues Public Apology for SK Telecom USIM Hacking Incident

(MHN Reporter Lee Keonhee) Chey Tae-won, Chairman of SK Group, publicly apologized to affected customers and citizens during a briefing session regarding the recent SK Telecom USIM hacking incident.

His official apology came 19 days after the hacking was first reported.

Chairman Chey stated, "The recent cyber breach at SK Telecom has caused anxiety and inconvenience to our customers and the public. On behalf of SK Group, I sincerely apologize."

He continued, "We inconvenienced many customers who had to visit our stores amid their busy schedules or were anxious before international departures. I believe many are still worried about potential damages. I want to once again express my apologies to all of them."

Chey also addressed the lack of proper communication following the incident, saying, "I deeply regret the insufficient communication. We failed to approach the situation from the customer's perspective, and both I and the management team reflect on this with a heavy heart."

He added, "We fully accept the criticisms from not only our customers but also the National Assembly and government agencies, and we will humbly take them to heart."

Chey emphasized that SK Group is prioritizing the identification of the incident's cause and announced plans to establish a "Security Innovation Committee" with the participation of experts to seek improvement measures.

Meanwhile, Chey is expected to be absent from the upcoming National Assembly's Science, ICT, Broadcasting, and Communications Committee hearing on the SK Telecom USIM hacking incident scheduled for May 8.

In the statement of absence submitted earlier, he cited his attendance at an event organized by the American Chamber of Commerce in Korea (AMCHAM) in preparation for the Asia-Pacific Economic Cooperation (APEC) Ministerial Meeting as the reason for his non-attendance.

On the same day, the National Assembly Research Service (NARS) raised concerns over the need for institutional improvements following the SK Telecom hacking incident and called for legal revisions.

In its report titled Problems and Legislative Tasks for Post-Hacking Incident Responses by Telecom Companies released on May 7, NARS stated, "If the core of a mobile network is hacked, it can significantly impact society and pose serious threats to national security."

The report urged amendments to the law, recommending that telecom companies notify all subscribers and apply flexible compensation measures even if specific victims are not identified.

The report particularly criticized SK Telecom for initially announcing the hacking incident only on its website and not sending out notifications to all subscribers until the 23rd of the previous month.

Consequently, NARS recommended, "Even if specific victims cannot be identified, telecom companies should notify all subscribers, assuming the worst-case scenario." It also called for amendments to the Personal Information Protection Act.

Additionally, the report proposed revisions to the Information and Communications Network Act and the Framework Act on Broadcasting and Communications Development to allow the use of emergency alert systems in case of widespread or severe hacking incidents.

The report referenced the 2022 SK C&C data center fire, during which emergency alerts were sent out three times, highlighting the lack of similar measures during the recent hacking case.

NARS also emphasized the need to strengthen the government's investigative powers by revising the Information and Communications Network Act. It noted that the current joint investigation led by the Ministry of Science and ICT lacks enforcement power when requesting data submission.

To prevent passive responses or incident concealment, the report suggested increasing fines and introducing enforcement penalties into the law.

Furthermore, it recommended that, given the difficulty victims face in proving the causal relationship between personal data breaches and damages, the Personal Information Protection Act should introduce provisions that presume causality.

The report also called for concurrent amendments to the Telecommunications Business Act, Information and Communications Network Act, and Personal Information Protection Act to ensure practical relief and easier compensation for victims.

Photo=YNA