Summary

  • Korea's Network Act gives the Ministry of Science and ICT explicit authority to inspect an operator after an incident and to order a correction, and the Telecommunications Business Act gives it a second, parallel corrective power.
  • The administrative fine for disobeying those orders is capped at KRW 30 million under one statute and KRW 10 million generally under the other, per the English consolidations read for this article.

Coverage of a serious telecom breach tends to divide into two halves: what the attacker did, and what the operator spent afterwards. The half in between — the legal instrument that converts a finding of fault into something an outsider can check — usually goes unreported. That is the half that decides whether a remedy is a duty or a press release.

Korea's framework is more explicit than its reputation suggests. The Act on Promotion of Information and Communications Network Utilization and Information Protection — the Network Act — brings telecommunications business operators inside its definition of information and communications service providers at Article 2(1)3. Article 45(1) requires protective measures to secure the reliability of information, and Article 45(3) names what those measures include: intrusion prevention, anti-leakage controls, continuity, and security governance. This is a substantive obligation, not an aspiration.

The enforcement machinery sits in Article 48-4. Paragraph (1) requires incident analysis, response, recovery and prevention of recurrence. Paragraph (2) authorises the Ministry of Science and ICT to order implementation measures, excluding public institutions. Paragraph (3) permits inspection and lets the ministry order a provider to make a correction. Article 64(4) adds corrective measures for statutory violations and public-announcement duties.

Read that sequence and the shape of a verifiable remedy becomes clear. An order under Article 48-4(3) is an instruction with a subject and a defect. It can be checked later by anyone with the same inspection right. A customer compensation package announced by an operator has no such property. It cannot be enforced, because nothing was ordered.

The second statute runs in parallel. Article 92(1) of the Telecommunications Business Act empowers the Ministry of Science and ICT or the Korea Communications Commission, within its jurisdiction, to order corrections for enumerated violations, seriously harmful business procedures, or unremedied service-disrupting accidents. Article 52(1)9 permits business-process improvement orders where a prohibited act under Article 50(1) is established. Article 53 penalty surcharges exist as a separate instrument from Article 104 administrative fines — the surcharge is the money, the fine is the enforcement of obedience.

Here is the part that should be read twice. Article 104(5)17 covers a person who fails to comply with a corrective order issued under Article 92(1) to (3). Paragraph (5) generally caps the administrative fine at KRW 10 million. Article 104(1)4 and 7 set KRW 50 million ceilings for investigative obstruction and specified large-enterprise noncompliance. On the Network Act side, Article 76(1)6-7 and 12 cap fines at KRW 30 million for disobeying an Article 48-4(3) or Article 64(4) order.

Thirty million won. That is the statutory ceiling for ignoring the ministry's instruction to fix what it found.

A law-firm commentary helps date the hardening. Kim & Chang's analysis of the 2024 amendments, published 26 September 2024, describes changes effective 14 August 2024 as replacing recommendations with authority to order necessary preventive measures. It reports an Annex 9 schedule for corrective-order noncompliance of KRW 7.5 million for a first violation, KRW 15 million for a second, and KRW 30 million for third and subsequent violations. That schedule comes from a secondary explainer, not from the text of Annex 9 itself, which was not retrieved here — attribute it accordingly.

This is where a widely repeated shorthand fails. Article 51 of the Telecommunications Business Act is frequently cited as the general security duty on operators. It is not. The official Korean text of Article 51 — 제51조(사실조사 등) — is a fact-finding provision: investigation, on-site inspection, compulsory production or temporary retention of materials. The English consolidation of the same Act contradicts the shorthand too. Article 51 gives the regulator eyes. It does not give the operator a duty.

There is a near-miss that explains the confusion. The Enforcement Decree of the Telecommunications Business Act, Article 51-2, does require equipment-security measures — but in connection with installation reporting and approval for important telecommunications equipment under Article 62(1) of the parent Act, and paragraph (3)2 has the ministry examine their appropriateness. It is subordinate legislation about equipment. It is not the parent Act's general cybersecurity duty.

The distinction is not pedantry. It determines what a third party should demand. If the duty lives in Article 45(1) of the Network Act and the enforceable instruction lives in Article 48-4(3) or Article 92(1), then the document to look for after a serious incident is a dated order naming the defect and the fix. Absent that document, a regulator has issued a finding and an operator has issued a plan, and neither is a legal obligation anyone can verify performance against.

That framing is the reason this article exists rather than another account of what the intruder did. Earlier reporting on the breach concentrated on the intrusion and on the operator's announced remedies. The legal shape of the enforcement instrument — whether fault hardens into a checkable instruction, and what disobeying that instruction actually costs — went untested, and the Article 51 misattribution travelled with it.

No dated Ministry of Science and ICT order, directive or fine decision concerning the April 2025 SK Telecom USIM breach appeared in the materials read for this article; the statutes above are cited as the framework an such an instrument must take, not as evidence that one was or was not issued, and this is a bound on what was read rather than a finding of absence. The Ministry of Science and ICT is recorded in the BTW directory as the regulator in question.

The ceiling is the story. A regulator that can order a national carrier to repair a defect, and can fine it KRW 30 million for refusing, has a lever measured in the price of an apartment's deposit rather than in the cost of a breached subscriber base. Read the order if it exists. Then read the penalty clause. The gap between them is where accountability actually lives.