A 2025 course scenario, and the April breach as the notes date it

The notes are framed as a virtual intelligence-collection and analysis scenario for a 2025 information-theory course, built around the SKT hacking case. That case, they say, has high value for analysis because domestic communications infrastructure was itself hit, and because it is an incident through which one can understand how an attack on national infrastructure proceeds. The student writer is an SKT user, and says the accident therefore felt more real, and became a reason for the choice.

The role invented for the scenario is a woman, 38 years old, a senior researcher at SKT’s authentication and security operations centre. Her stated trait is that she knows the structure of the authentication servers and the internal security flow as well as anyone; on the outside she looks firm, but in fact she feels a responsibility for sharing accurate information. What follows in the notes is told inside that invented role and assignment, not as an official investigation.

In the scenario’s telling, SKT suffered a large-scale breach in April. That April stays in the 2025 frame of the course and of the citations the notes list — among them Han Se-hui, 22 April 2025, in BoanNews, “SKT hacked… customer USIM information leaked” — and is not treated here as a later official audit. The range of leaked information is said to have included main identifiers such as telephone numbers, IMSI, and USIM authentication keys. Because communications infrastructure had been attacked, interest at the scale of the nation grew, and the case was classed as a major cyber-security incident requiring a joint response by government and company.

OSINT, HUMINT, and SIGINT, as the assignment asks for them

To understand the incident for the first time, the student looked through a number of news stories and reports in the security press. Comparing press materials, they could confirm that the kinds of information leaked and the time of the incident matched; they also reviewed government announcements and tidied the objective facts of the case. But public information alone, they write, could not fully explain the method of attack or the actual shape of harm, so OSINT was used with a focus on setting the overall frame of the situation. Among the open sources listed are Jo Jae-ho, 28 July 2025, in BoanNews, on SKT beginning individual notifications of a personal-information leak and also opening a site for checking leaks; the April 2025 BoanNews item already named; and an SBS News broadcast of 3 October 2024, on YouTube, about reporting related to the SKT hack. Those dates stay in 2025 and 2024 as given.

Parts hard to confirm from public material were, in the scenario, to be filled in through people. An acquaintance then working in a senior post at SKT could be heard, indirectly, on the internal situation, and explained in outline how the technical team and the security team were responding. Such human information, the student writes, helped in understanding actual movement inside the organization that does not show in documents. Later in the scenario the student moves quietly, watches people’s reactions and the atmosphere, and happens to meet a customer who says they have suffered actual harm. A recording is switched on for an interview; the customer speaks of odd phenomena in text messages and of errors in account authentication. Listening again in the noise of a café, the student compares what they already knew with lived experience, and concludes that the shapes of harm are more various and more real than the articles had suggested. These steps remain part of the coursework scenario.

Korean studies, the notes record, repeatedly present log-based detection of unusual behaviour, packet analysis, and the monitoring of authentication procedures as core techniques when a breach is being traced. Papers in Korea on the forensics of information-leak incidents, they add, explain that signals such as unusual traffic patterns appearing in a particular window of time, persistent reconnection with an external IP, and a sharp rise in authentication errors are important as early grounds for identification. Those analytic principles, dated in the reference list to work such as Park Dae-woo (2015), Im Gyu-geon (2018), and Kim Min-cheon (2016), are applied inside the scenario: network logs are checked again in detail, and the fact of an intrusion and a path of movement are estimated. Still inside the assignment, the student also looks at related network logs and signal data, notices unusual connections that appear repeatedly in a particular window when compared with the normal flow, and finds a record of requests unlike the usual ones concentrated in the server-authentication section, which narrows the time of the attack. Field gear named in the scenario includes a portable traffic analyser, an RF scanner, and a portable log-collection device; at first the data are too complex and the equipment unfamiliar, but after patterns are compared and shared with teammates, unusual request patterns are somewhat confirmed as related to the authentication-server section.

What the scenario concludes, and the citations it leaves in 2025

The final analysis in the scenario concludes that an actual breach occurred in the section of SKT’s authentication servers, and that some core subscriber information was leaked. The harm at present is described as limited, but the leaked information is said to have a high possibility of being used in a second attack — smishing, the taking of an account, fraud involving a change of carrier, and the like — so that continuous monitoring and response are needed. Technical analysis and information from the field, the draft report says, pointed in the same direction, so that the time of the attack and a path of approach became clearer, and a further attempt remains possible. SKT is conducting its own response, but customer anxiety is growing, and a government-level tidying of the situation and further guidance are said to be required. The incident is treated as a signal that the security level of communications infrastructure should be checked again, and that structural supplements and policy measures are needed.

The assignment, as written, has the student combine the OSINT, HUMINT, and SIGINT information collected, write a final report that clearly tidies the cause of the breach and the range of the leak, evaluate from a policy point of view how the incident affected communications infrastructure and the system for protecting citizens’ information, attach as technical grounds the path, the time, and the signal patterns confirmed in the log-based analysis, and deliver that report directly to the president, explaining the facts of the case and the direction of a response in brief. That last step belongs to the invented scenario, not to a public official record.

Besides the 2025 and 2024 news items already named, the notes list Im Gyu-geon (2018), a study at Hanyang University on a model for calculating the cost of harm from a leak of personal information; Park Dae-woo (2015), on trends in mobile smishing and on security measures, in the Journal of the Korea Institute of Information and Communication Engineering, 19(11), pages 2615–2622; and Kim Min-cheon (2016), an analysis of Korea’s system for protecting personal information, in Informatization Policy, 23(4). Those years stay as the citations give them. The same Korean report, at fuller length, is on CampusDown.

Sources

1. Notes framed as a virtual intelligence-collection scenario for a 2025 information-theory course, built around the SKT breach, with an invented role at an authentication and security operations centre.
2. OSINT from news, security reporting, and government announcements, including BoanNews items of 22 April and 28 July 2025 and an SBS News item of 3 October 2024, with those dates left in place.
3. HUMINT and SIGINT steps told inside the assignment; a scenario conclusion about a leak of identifiers such as telephone numbers, IMSI, and Ki/Opc; and studies cited from 2015, 2016, and 2018.

Last updated: 14 November 2026