2026 SK Telecom — DarkForums ~21M subscriber database sale claim (unverified; sample flagged)
Data compromised
Actor-claimed: customer IDs, full names, DOB, emails, MSISDN, IMSI, SIM/subscriber management data, plans, devices, payment methods, usage metrics, roaming, balances, VAS records — unverified; sample quality disputed
Technical writeup
Unverified cybercrime-forum sale claim — observed June 26, 2026. DailyDarkWeb reported a threat actor advertising an alleged SK Telecom subscriber dataset of approximately 21 million records (customer IDs, names, dates of birth, emails, MSISDN/IMSI, SIM management fields, plans, devices, payment methods, usage/roaming metrics). Team_D4rkn3ttz reviewed the exposed sample and reported multiple fabrication indicators: example.com placeholder emails, conspicuously sequential Korean mobile numbers (e.g., 010-1234-5678 series), uniform English template fields, and no verifiable export metadata or provenance. BreachHistory indexes the actor marketing count (21,000,000) as unverified and notes the sample may be synthetic rather than a validated SKT dump. This row is distinct from the verified April 2025 USIM/SIM authentication breach (~23.2M subscribers; PIPC later cited ~26.1M plaintext SIM authentication keys), which remains catalogued as sk-telecom2025-vcdb1. Do not conflate the ~26M plaintext-key figure from the 2025 PIPC findings with this June 2026 forum listing.
Root cause
Unverified DarkForums sale listing advertising an alleged SK Telecom subscriber database (~21M records); independent analysts flagged the published sample as consistent with fabricated/synthetic data — SK Telecom had not confirmed a new dump at indexing time