LG Uplus CEO国会听证就黑客隐瞒指控作有条件担责表态，拒绝承诺减免用户违约金

LG Uplus CEO Hong Beom-sik said the company would take appropriate responsibility if allegations of concealing a hacking incident and obstructing an investigation were confirmed. However, he stopped short of committing to waive early termination fees for subscribers, as demanded by lawmakers.
Hong appeared as a witness at the National Assembly’s Science, ICT, Broadcasting and Communications Committee audit of the Ministry of Science and ICT on Oct. 23. “If all of these allegations, including the concealment of a hacking incident, are confirmed to be true, we will certainly take appropriate responsibility,” he said.
His remarks came in response to a question from Cho Kyung-tae of the People Power Party, who asked whether LG Uplus would waive subscribers’ early termination fees if a police investigation found that the company had deliberately concealed the hacking incident or obstructed the investigation.
Lee Hoon-ki of the Democratic Party also noted that an investigation into the alleged cover-up was underway and again asked whether the company would waive the fees. Hong replied, “We will take measures to protect customers and users based on the findings of the judicial authorities.”
Han Jun-ho of the Democratic Party pressed Hong for another answer, pointing out that subscribers would have to pay penalties to terminate their contracts with LG Uplus. “I apologize for repeating myself,” Hong said, reiterating that the company would take measures commensurate with its responsibility depending on the investigation’s findings.
While Hong declined to explicitly promise a waiver, the government has already indicated that waiving cancellation fees may be necessary depending on the investigation’s outcome. At a parliamentary audit on Oct. 6, Deputy Prime Minister and Minister of Science and ICT Bae Kyung-hoon said fee waivers should be requested if deliberate destruction of evidence or obstruction of an investigation were confirmed. He also said waivers should be implemented in cases involving serious service disruptions or violations of essential contractual obligations.
The controversy stems from an internal server information leak at LG Uplus in 2025. The Korea Internet & Security Agency (KISA) notified LG Uplus of suspected hacking activity on July 19, 2025. However, LG Uplus disposed of one of the servers involved on July 31 and reinstalled the operating system on an integrated server access management system (APPM) server on Aug. 12.
Announcing the findings of a joint public-private investigation on Dec. 29, 2025, the Ministry of Science and ICT confirmed that LG Uplus server lists, account information and employee names had been leaked. However, it said the disposal of the server and reinstallation of the operating system had erased traces of the intrusion, limiting investigators’ ability to determine the precise entry point and whether additional damage had occurred. The government had referred the case to police on Dec. 9 to investigate possible obstruction of the inquiry.
At the Oct. 23 hearing, LG Uplus’ explanation for preserving evidence based on its redundant server architecture also came under scrutiny.
Han questioned how LG Uplus had concluded that preserving data from only one server was sufficient because data was synchronized between redundant servers. He challenged whether synchronization alone could establish that evidence from a server suspected of being compromised had been preserved when the two servers operated independently.
Hong Kwan-hee, LG Uplus’ chief information security officer (CISO), said he understood that data was synchronized between the servers but acknowledged, “I apologize for the shortcomings in our evidence preservation measures.”
Han pointed out that reinstalling an operating system could erase existing malware and traces of an intrusion. He raised concerns that replicating business data across redundant servers would not necessarily preserve malware, system logs or memory information from the time of the breach. Without the original data from the suspected compromised server, investigators could face difficulties fully reconstructing the hacking route using data from another server alone.
Police are currently investigating whether the alleged concealment of the hacking incident and obstruction of the investigation were intentional.