SK Telecom had already stopped using the Ivanti VPN device suspected of being linked to a recent hacking incident, according to a government report released on May 8.
Documents submitted to lawmaker Choi Min-hee, a member of the National Assembly’s Science, Technology, Information, Broadcasting and Communications Committee, show that SK Telecom turned off the Ivanti VPN and switched to a different device early last month. The telecom giant had been using both a domestic product called SecuWiz and the Ivanti VPN before making the change.
SK Telecom said it made the switch after receiving a cybersecurity alert from the Korea Internet & Security Agency (KISA), which recommended turning off the Ivanti VPN. The company completed the replacement in line with that guidance. SK Shieldus, a cybersecurity firm, had previously warned about vulnerabilities in the Ivanti VPN in a report published in September last year.
Lawmaker Choi Min-hee has called for a detailed investigation. She wants authorities to check whether any security risks were exposed while the Ivanti VPN was in use and whether proper procedures were followed during the shutdown and replacement.
Meanwhile, tech companies Naver and Kakao confirmed they are still using the Ivanti VPN. Both companies said they will take immediate action if any vulnerabilities are officially reported. Kakao also stated that it has installed the latest security patches and is actively monitoring for threats. So far, there is no evidence of communication between Kakao’s network and the attacker’s IP address.
SK Telecom clarified that its key USIM-related servers are located in data centers in Seong-su and Daejeon. These centers operate as backups for each other. The company added that subscriber authentication keys are stored in three data centers—in Daejeon, Seoul’s Boramae area, and Bundang. If one center is compromised, the others are able to maintain service and security.
