SK Telecom (KRX:017670) is facing up to 30 million won in fines and has been ordered to carry out sweeping security reforms after a major data breach exposed the USIM information of 26.96 million users.

USIM stands for universal subscriber identity module cards used in smartphones.

The breach, caused by poor account management and unencrypted sensitive data, affected 28 servers and leaked 9.82GB of information, South Korea's Ministry of Science and ICT said in a Friday release.

The government ordered SK Telecom to strengthen password controls, encrypt key user data, improve breach reporting practices, and restructure its cybersecurity governance by mandating the chief security officer to report directly to the CEO.

In response, SK Telecom announced a variety of measures to compensate its affected customers and bolster its information protection.

The company said it will invest 700 billion won over five years to set up an information protection system, guided by the US National Institute of Standards and Technology's Cybersecurity Framework.

The telecom company also rolled out a 500 billion won customer relief program that includes free SIM replacements, enhanced fraud detection, extra mobile data, August bill discounts, and waived cancellation fees for affected users.

SK Telecom slashed its 2025 sales forecast to 170 trillion won from 178 trillion won to account for the cost of the customer benefit package tied to the data breach.

Shares of SK Telecom fell nearly 6% at market close.