A breach is also an investigation.
In its July 2026 decision concerning KT, PIPC described both a mobile-payment incident and malware found on internal servers. The investigation examined what could be established from technical records — and what could not.
PIPC said certain relevant network logs were unavailable. It also said KT had deleted logs from some affected servers before the investigation. Without records, a regulator cannot reliably reconstruct scope, timing, or the personal data that may have been accessed.
Why this reaches beyond KT.
The same PIPC notice discussed a potential LG U+ breach following a report by the hacking magazine Phrack. The commission said the company had reinstalled operating systems and decommissioned affected servers before its investigation, making fact-finding more difficult.
For the public, this is exactly why an incident index should not force every early report into “confirmed” or “false.” Evidence can be incomplete, investigation can be obstructed, and the status needs to reflect that uncertainty honestly.
The 72-hour question.
Korean personal-information law requires notification and reporting without undue delay, generally within 72 hours once a controller becomes aware of a breach. That clock is not only a legal detail: it gives people time to change passwords, watch payments, and spot impersonation attempts.
A fast disclosure is not proof that every answer is already known. It is an acknowledgement that affected people should not have to wait for a perfect investigation before protecting themselves.