Identity Theft in Korea: 2025's Unprecedented Data Breach Wave

2025 has been called "the year of data breaches" in South Korea, with an unprecedented series of massive security incidents affecting tens of millions of citizens. The three major telecoms were all hacked in the same year, and Coupang — Korea's largest e-commerce platform — suffered a breach exposing 33.7 million accounts.

If you have any connection to Korean digital services, your personal data may already be compromised.

The Major 2025 Data Breaches

Incident	Scale	Data Exposed
Coupang	33.7 million accounts	Emails, phone numbers, addresses (perpetrated by a former Chinese employee)
SKT	23.24 million USIM records	USIM authentication data, subscriber information
KT	Femtocell attack	Communications intercepted via illegal micro base stations
LGU+	Server hack	Subscriber personal information

All three Korean telecoms being hacked in the same year is unprecedented.

Why Korean Identity Theft Is Especially Dangerous

South Korea's Resident Registration Number (주민등록번호) is a uniquely powerful identifier — it's used for banking, telecom services, government services, and online verification. Unlike a Social Security Number, it's extremely difficult to change.

Risk	What Happens
Ghost phone lines	Phones opened in your name for criminal use
Fraudulent bank accounts	Accounts created for money laundering
Loan fraud	Loans taken out in your name
Credit card fraud	Cards issued and used without your knowledge
Service abuse	Online accounts created for scams

How to Check If Your Data Was Exposed

1. PASS App — Identity Theft Prevention

The PASS app (operated jointly by all three Korean telecoms) offers free identity theft prevention:

• View all phone lines registered under your name
• Real-time alerts when someone attempts to open a new line
• Block new registrations

2. Personal Information Exposure Check — privacy.go.kr

The Korean government's privacy.go.kr service lets you check whether your Resident Registration Number has been exposed online.

3. Financial Account Monitoring

The Financial Supervisory Service's Account Information Integration Service shows all financial accounts opened under your name. If you see accounts you didn't open, report immediately.

4. Credit Checks — NICE and KCB

Check your credit reports through NICE and KCB (AllCredit) to spot unauthorized loans or credit cards.

Post-Breach Action Checklist

Step	Action	Method
1	Freeze credit inquiries	Apply through NICE/KCB — prevents new loans/cards in your name
2	Change all passwords	Banking, portals, email — use unique passwords for each
3	Enable 2FA everywhere	All financial and portal accounts
4	Set PASS app alerts	Real-time identity theft attempt notifications
5	Block non-face-to-face registration	Request at your telecom carrier
6	Reissue digital certificates	Revoke old ones, visit bank for new ones

Everyday Identity Protection

Password Hygiene

• Use different passwords for every service
• Use a password manager (1Password, Bitwarden)
• Minimum 12 characters with mixed case, numbers, and symbols

Two-Factor Authentication

• Mandatory for all financial services
• Prefer TOTP apps (Google Authenticator) over SMS verification
• SMS can be intercepted through SIM swapping attacks

Minimize Data Exposure

• Question why any service needs your Resident Registration Number
• Check if there's a legal basis for collecting it
• Consider the RRN change program for severe identity theft cases

Storing Sensitive Information Securely

Many people store sensitive information — ID numbers, insurance details, bank accounts — in their phone's notes app or chat messages. If your phone is lost or hacked, this data is immediately exposed.

LOCK.PUB's encrypted memo feature lets you store critical personal information in a password-protected, encrypted format.

What to Store in an Encrypted Memo

Category	Information
Financial	Bank account numbers, card customer service numbers, fraud hotlines
Authentication	2FA backup codes, recovery keys
Emergency	Family contacts, lawyer, insurance agent
Medical	Insurance number, doctor's contact, blood type, allergies

Share the password with trusted family members to create a digital emergency binder that's accessible when needed but secure at all times.

Key Takeaways

The 2025 breach wave teaches us to operate under the assumption that our data has already been compromised. Monitor your identity through the PASS app, freeze credit inquiries, enable 2FA everywhere, and store sensitive information securely with LOCK.PUB.

Prevention is 100 times easier than recovery.