Cybersecurity Risk Management and Strategy Disclosure	12 Months Ended
Dec. 31, 2025
Cybersecurity Risk Management, Strategy, and Governance [Line Items]
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]	Risk Management and Strategy We maintain a comprehensive process for assessing, identifying and managing material risks from cybersecurity threats as part of our overall risk management system and processes. We understand the importance of preserving trust and protecting personal and other confidential information. Cybersecurity is a critical component of our overall risk management system and we have established an information security and cybersecurity framework to help safeguard the confidentiality, integrity and access of our information assets, and to ensure regulatory, contractual and operational compliance. We utilize policies, software, training programs and hardware solutions to protect and monitor our environment, including multifactor authentication, firewalls, intrusion detection and prevention systems, vulnerability and penetration testing, and identity management systems. Our information security and cybersecurity framework and infrastructure comply with and incorporate the International Organization for Standardizations (“ISO”) standards. In February 2026, we reorganized our security governance system, which seeks to maximize execution power by combining ISO 27002 with ISO 27001. Our Chief Information Security Officer (“CISO”), under the direct supervision of our Chief Executive Officer, oversees our approach to managing cybersecurity and digital risk and regularly engages with cross-functional teams including legal, human resources, facilities and corporate risk. We also carry insurance that provides protection against potential losses arising from cybersecurity incidents and annually review our policy and levels of coverage based on current risks. We conduct annual information security awareness training for all directors, officers and employees and enhanced training for specialized personnel, such as personal information handlers, location information handlers and information security managers, and publish periodic cybersecurity newsletters to highlight any emerging or urgent security threats. We also conduct cyber awareness training and run tabletop exercises to simulate responses to cybersecurity incidents, and use the findings to improve our practices, procedures and technologies. We also engage with a range of external experts, including cybersecurity assessors and consultants, to assess and report on the effectiveness of our cybersecurity and data privacy controls, and our internal incident response preparedness, as well as to help identify areas for continued focus and improvement. In addition, we engage outside legal counsel regarding cybersecurity issues such as regulatory compliance, materiality determinations, disclosure obligations and best practices for oversight, as needed. Since 2006, we have been a member of CONCERT, a Government-sponsored organization which allows members to share best practices, fight cybercrime, enhance privacy, discuss new technologies and better understand the evolving regulatory environment and advance capabilities in these areas. Our cybersecurity risk management processes extend to the oversight and identification of threats associated with our use of third-party service providers. We review our vendors’ cybersecurity practices before we enter into business transactions with them, and we seek to contractually obligate vendors to operate their environments in accordance with strict cybersecurity standards. We also develop contingency plans for business continuity if our vendors are subject to a cyberattack that impacts our use of their systems. Furthermore, we assess the risks faced by our partners, including branch offices and stores in our extensive distribution network, at least once a year in order to assess risks and identify threats and vulnerabilities, and implement corrective measures. Since 2015, we have been engaging third-party assessors to conduct annual audits of our distribution network and have been conducting remote diagnoses of all personal information-processing personal computers on a weekly basis. Our internal audit department conducts annual audits to review and evaluate the effectiveness of our internal controls relating to information security and disclosure obligations. On April 18, 2025, we became aware of a malware attack against our information technology infrastructure, which resulted in the leakage of certain USIM information of our 5G and LTE network subscribers. Upon becoming aware of such incident, we promptly deleted the malware and segregated the targeted equipment, and we have yet to find any instance of actual or attempted misuse of such information. We also alerted the Government authorities and our customers of such attack, and promptly took further measures to mitigate the potential impact of such attack, including by engaging in a comprehensive audit of our entire network system, strengthening our monitoring efforts against USIM swap frauds and unauthorized authentication attempts, and offering free USIM protection services and free replacement of USIM cards to our subscribers to block any unauthorized misuse of their USIM information, while also cooperating with Government authorities in their investigations of this incident. From May 5, 2025 to June 23, 2025, we temporarily suspended new subscriptions of mobile phone services to alleviate the shortage of USIM card replacement inventory in accordance with administrative guidance from the MSIT. Furthermore, on July 4, 2025, in order to reaffirm our commitment and restore customer trust, we announced the “Accountability and Commitment Program” consisting of the “Customer Assurance Package,” “Information Protection Innovation Plan,” “Customer Appreciation Package” and “Subscription Cancellation Fee Waiver.” Under the Customer Assurance Package, we have been providing free subscriptions to a leading third-party mobile device security solution for all customers for one year beginning in November 2025, among other things. Under the Information Protection Innovation Plan, we announced our intent to invest approximately Won 700 billion over the course of the next five years to strengthen our cybersecurity technology, infrastructure and personnel. Under the Customer Appreciation Package, we provided a range of economic benefits to our customers totaling approximately Won 500 billion in value during the second half of 2025. Such benefits included discounts on monthly subscription fees for the month of August 2025 and free additional mobile data until the end of 2025, as well as significant membership discounts redeemable at our various partnering merchants and special benefits for returning customers, in each case subject to applicable terms and conditions. Under the Subscription Cancellation Fee Waiver, we waived the subscription cancellation fees for customers who canceled their subscriptions between April 19, 2025 (which was the date of the public announcement of the cybersecurity incident) and July 14, 2025. The number of our mobile phone subscribers decreased by approximately 0.73 million over such period. In August 2025, the Telecommunications Dispute Resolution Committee under the KMCC recommended that we waive cancellation fees through year-end and reduce bundled wireless and fixed-line telecommunications service cancellation fees by 50%. We declined this recommendation in September 2025. On August 27, 2025, the PIPC imposed a fine of Won 134.8 billion and an administrative penalty of Won 9.6 million and issued a correctional order on us in connection with this incident. While we have provisionally paid the fine and the administrative penalty in full, we filed an administrative lawsuit challenging such decision in January 2026, which case is currently pending before the Seoul Administrative Court. In addition, certain of our mobile phone service subscribers have sought dispute mediation with relevant authorities to make damage claims in connection with their alleged losses relating to the incident. To date, we have declined to accept the authorities’ proposed settlements. See “Item 8.A. Consolidated Statements and Other Financial Statements — Legal Proceedings — Other Proceedings.” Certain of our mobile phone service subscribers have also filed a number of civil lawsuits seeking alleged damages in connection with this incident, all of which are currently pending before trial courts. While we are vigorously defending ourselves in each of these cases, we are unable to predict their outcomes, and no assurance can be made that additional customers will not pursue additional legal actions to seek alleged damages against us in connection with this incident. Actual or perceived breaches of our cybersecurity of a material nature, or material harm to the market perception of the effectiveness of our cybersecurity measures may require us to incur significant legal and financial exposure, including legal claims and regulatory fines and penalties, monetary compensation to our customers, damage to our reputation and a loss of confidence of our customers, which could have a material adverse effect on our business, financial condition and results of operations. Other than as describe above, our business, financial condition and results of operations have not been materially affected by risks from cybersecurity threats, including as a result of previous cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks and any future material incidents. Governance Management The cybersecurity risk management processes described above are managed by our CISO, Henry Jong-Hyeon Lee, who was newly appointed in August 2025. Our CISO has more than 12 years of experience in the area of information technology and more than 22 years of experience in the area of information protection. In order to streamline our information protection and privacy governance regime, we operate an integrated security center led by our CISO to prevent common malicious and abusive Internet activities, such as spam, hacking of personal information, distributed denial-of-service attacks and dissemination of viruses, worms and other destructive or disruptive software, and to respond in real time when a situation arises. We also hold an Information Protection Committee meeting every week under the leadership of our CISO. Furthermore, key executive officers such as our Chief Operating Officer and Chief Serious-accident Prevention Officer manage company-wide information security risks under the leadership of our Chief Executive Officer. Board of Directors Our board of directors is committed to mitigating data privacy and cybersecurity risks and recognizes the importance of these issues as part of our risk management framework. Our board of directors maintains ultimate responsibility for the oversight of our data privacy and cybersecurity program. In addition, our board of directors receives quarterly review reports covering the status of the company’s management and protection of personal credit information from our CISO. For information security issues that have a company-wide impact, our board of directors convenes a crisis response situation room to directly engage with and advise our CISO, and the CISO reports to the board of directors the results of work performed based on such advice. Furthermore, we have established a “red team” under our CISO, which objectively assesses our security status and proposes improvement measures. O ur board of directors’ principal role is one of oversight, recognizing that management is responsible for the design, implementation and maintenance of an effective program for protecting against and mitigating data privacy and cybersecurity risks. Members of the board of directors stay apprised of the rapidly evolving cyber threat landscape and provide guidance to management as appropriate in order to address the effectiveness of our overall data privacy and cybersecurity program.
Cybersecurity Risk Management Processes Integrated [Flag]	true
Cybersecurity Risk Management Processes Integrated [Text Block]	we operate an integrated security center led by our CISO to prevent common malicious and abusive Internet activities, such as spam, hacking of personal information, distributed denial-of-service attacks and dissemination of viruses, worms and other destructive or disruptive software, and to respond in real time when a situation arises.
Cybersecurity Risk Management Third Party Engaged [Flag]	true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag]	true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag]	false
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Text Block]	our business, financial condition and results of operations have not been materially affected by risks from cybersecurity threats, including as a result of previous cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks and any future material incidents.
Cybersecurity Risk Board of Directors Oversight [Text Block]	O ur board of directors’ principal role is one of oversight, recognizing that management is responsible for the design, implementation and maintenance of an effective program for protecting against and mitigating data privacy and cybersecurity risks. Members of the board of directors stay apprised of the rapidly evolving cyber threat landscape and provide guidance to management as appropriate in order to address the effectiveness of our overall data privacy and cybersecurity program.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block]	We also engage with a range of external experts, including cybersecurity assessors and consultants, to assess and report on the effectiveness of our cybersecurity and data privacy controls, and our internal incident response preparedness, as well as to help identify areas for continued focus and improvement. In addition, we engage outside legal counsel regarding cybersecurity issues such as regulatory compliance, materiality determinations, disclosure obligations and best practices for oversight, as needed. Since 2006, we have been a member of CONCERT, a Government-sponsored organization which allows members to share best practices, fight cybercrime, enhance privacy, discuss new technologies and better understand the evolving regulatory environment and advance capabilities in these areas. Our cybersecurity risk management processes extend to the oversight and identification of threats associated with our use of third-party service providers. We review our vendors’ cybersecurity practices before we enter into business transactions with them, and we seek to contractually obligate vendors to operate their environments in accordance with strict cybersecurity standards. We also develop contingency plans for business continuity if our vendors are subject to a cyberattack that impacts our use of their systems. Furthermore, we assess the risks faced by our partners, including branch offices and stores in our extensive distribution network, at least once a year in order to assess risks and identify threats and vulnerabilities, and implement corrective measures. Since 2015, we have been engaging third-party assessors to conduct annual audits of our distribution network and have been conducting remote diagnoses of all personal information-processing personal computers on a weekly basis.
Cybersecurity Risk Role of Management [Text Block]	O ur board of directors’ principal role is one of oversight, recognizing that management is responsible for the design, implementation and maintenance of an effective program for protecting against and mitigating data privacy and cybersecurity risks. Members of the board of directors stay apprised of the rapidly evolving cyber threat landscape and provide guidance to management as appropriate in order to address the effectiveness of our overall data privacy and cybersecurity program.
Cybersecurity Risk Management Positions or Committees Responsible [Flag]	true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block]	The cybersecurity risk management processes described above are managed by our CISO, Henry Jong-Hyeon Lee, who was newly appointed in August 2025. Our CISO has more than 12 years of experience in the area of information technology and more than 22 years of experience in the area of information protection. In order to streamline our information protection and privacy governance regime, we operate an integrated security center led by our CISO to prevent common malicious and abusive Internet activities, such as spam, hacking of personal information, distributed denial-of-service attacks and dissemination of viruses, worms and other destructive or disruptive software, and to respond in real time when a situation arises. We also hold an Information Protection Committee meeting every week under the leadership of our CISO. Furthermore, key executive officers such as our Chief Operating Officer and Chief Serious-accident Prevention Officer manage company-wide information security risks under the leadership of our Chief Executive Officer.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block]	Our CISO has more than 12 years of experience in the area of information technology and more than 22 years of experience in the area of information protection.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block]	O ur board of directors’ principal role is one of oversight, recognizing that management is responsible for the design, implementation and maintenance of an effective program for protecting against and mitigating data privacy and cybersecurity risks. Members of the board of directors stay apprised of the rapidly evolving cyber threat landscape and provide guidance to management as appropriate in order to address the effectiveness of our overall data privacy and cybersecurity program.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag]	true

Cybersecurity Risk Management and Strategy Disclosure

12 Months Ended

Dec. 31, 2025

Cybersecurity Risk Management, Strategy, and Governance [Line Items]

Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]

Risk Management and Strategy

We maintain a comprehensive process for assessing, identifying and managing material risks from cybersecurity threats as part of our overall risk management system and processes.

We understand the importance of preserving trust and protecting personal and other confidential information. Cybersecurity is a critical component of our overall risk management system and we have established an information security and cybersecurity framework to help safeguard the confidentiality, integrity and access of our information assets, and to ensure regulatory, contractual and operational compliance. We utilize policies, software, training programs and hardware solutions to protect and monitor our environment, including multifactor authentication, firewalls, intrusion detection and prevention systems, vulnerability and penetration testing, and identity management systems.

Our information security and cybersecurity framework and infrastructure comply with and incorporate the International Organization for Standardizations (“ISO”) standards. In February 2026, we reorganized our security governance system, which seeks to maximize execution power by combining ISO 27002 with ISO 27001.

Our Chief Information Security Officer (“CISO”), under the direct supervision of our Chief Executive Officer, oversees our approach to managing cybersecurity and digital risk and regularly engages with cross-functional teams including legal, human resources, facilities and corporate risk. We also carry insurance that provides protection against potential losses arising from cybersecurity incidents and annually review our policy and levels of coverage based on current risks.

We conduct annual information security awareness training for all directors, officers and employees and enhanced training for specialized personnel, such as personal information handlers, location information handlers and information security managers, and publish periodic cybersecurity newsletters to highlight any emerging or urgent security threats. We also conduct cyber awareness training and run tabletop exercises to simulate responses to cybersecurity incidents, and use the findings to improve our practices, procedures and technologies.

We also engage with a range of external experts, including cybersecurity assessors and consultants, to assess and report on the effectiveness of our cybersecurity and data privacy controls, and our internal incident response preparedness, as well as to help identify areas for continued focus and improvement. In addition, we engage outside legal counsel regarding cybersecurity issues such as regulatory compliance, materiality determinations, disclosure obligations and best practices for oversight, as needed. Since 2006, we have been a member of CONCERT, a Government-sponsored organization which allows members to share best practices, fight cybercrime, enhance privacy, discuss new technologies and better understand the evolving regulatory environment and advance capabilities in these areas.

Our cybersecurity risk management processes extend to the oversight and identification of threats associated with our use of third-party service providers. We review our vendors’ cybersecurity practices before we enter into business transactions with them, and we seek to contractually obligate vendors to operate their environments in accordance with strict cybersecurity standards. We also develop contingency plans for business continuity if our vendors are subject to a cyberattack that impacts our use of their systems. Furthermore, we assess the risks faced by our partners, including branch offices and stores in our extensive distribution network, at least once a

year in order to assess risks and identify threats and vulnerabilities, and implement corrective measures. Since 2015, we have been engaging third-party assessors to conduct annual audits of our distribution network and have been conducting remote diagnoses of all personal information-processing personal computers on a weekly basis.

Our internal audit department conducts annual audits to review and evaluate the effectiveness of our internal controls relating to information security and disclosure obligations.

On April 18, 2025, we became aware of a malware attack against our information technology infrastructure, which resulted in the leakage of certain USIM information of our 5G and LTE network subscribers.

Upon becoming aware of such incident, we promptly deleted the malware and segregated the targeted equipment, and we have yet to find any instance of actual or attempted misuse of such information.

We also alerted the Government authorities and our customers of such attack, and promptly took further measures to mitigate the potential impact of such attack, including by engaging in a comprehensive audit of our entire network system, strengthening our monitoring efforts against USIM swap frauds and unauthorized authentication attempts, and offering free USIM protection services and free replacement of USIM cards to our subscribers to block any unauthorized misuse of their USIM information, while also cooperating with Government authorities in their investigations of this incident. From May 5, 2025 to June 23, 2025, we temporarily suspended new subscriptions of mobile phone services to alleviate the shortage of USIM card replacement inventory in accordance with administrative guidance from the MSIT. Furthermore, on July 4, 2025, in order to reaffirm our commitment and restore customer trust, we announced the “Accountability and Commitment Program” consisting of the “Customer Assurance Package,” “Information Protection Innovation Plan,” “Customer Appreciation Package” and “Subscription Cancellation Fee Waiver.” Under the Customer Assurance Package, we have been providing free subscriptions to a leading third-party mobile device security solution for all customers for one year beginning in November 2025, among other things. Under the Information Protection Innovation Plan, we announced our intent to invest approximately Won 700 billion over the course of the next five years to strengthen our cybersecurity technology, infrastructure and personnel. Under the Customer Appreciation Package, we provided a range of economic benefits to our customers totaling approximately Won 500 billion in value during the second half of 2025. Such benefits included discounts on monthly subscription fees for the month of August 2025 and free additional mobile data until the end of 2025, as well as significant membership discounts redeemable at our various partnering merchants and special benefits for returning customers, in each case subject to applicable terms and conditions. Under the Subscription Cancellation Fee Waiver, we waived the subscription cancellation fees for customers who canceled their subscriptions between April 19, 2025 (which was the date of the public announcement of the cybersecurity incident) and July 14, 2025. The number of our mobile phone subscribers decreased by approximately 0.73 million over such period. In August 2025, the Telecommunications Dispute Resolution Committee under the KMCC recommended that we waive cancellation fees through

year-end

and reduce bundled wireless and fixed-line telecommunications service cancellation fees by 50%. We declined this recommendation in September 2025.

On August 27, 2025, the PIPC imposed a fine of Won 134.8 billion and an administrative penalty of Won 9.6 million and issued a correctional order on us in connection with this incident. While we have provisionally paid the fine and the administrative penalty in full, we filed an administrative lawsuit challenging such decision in January 2026, which case is currently pending before the Seoul Administrative Court. In addition, certain of our mobile phone service subscribers have sought dispute mediation with relevant authorities to make damage claims in connection with their alleged losses relating to the incident. To date, we have declined to accept the authorities’ proposed settlements. See “Item 8.A. Consolidated Statements and Other Financial Statements — Legal Proceedings — Other Proceedings.” Certain of our mobile phone service subscribers have also filed a number of civil lawsuits seeking alleged damages in connection with this incident, all of which are currently pending before trial courts. While we are vigorously defending ourselves in each of these cases, we are unable to predict their outcomes, and no assurance can be made that additional customers will not pursue additional legal actions to seek alleged damages against us in connection with this incident.

Actual or perceived breaches of our cybersecurity of a material nature, or material harm to the market perception of the effectiveness of our cybersecurity measures may require us to incur significant legal and financial exposure, including legal claims and regulatory fines and penalties, monetary compensation to our customers, damage to our reputation and a loss of confidence of our customers, which could have a material adverse effect on our business, financial condition and results of operations.

Other than as describe above, our business, financial condition and results of operations have not been materially affected by risks from cybersecurity threats, including as a result of previous cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks and any future material incidents.

Governance

Management

The cybersecurity risk management processes described above are managed by our CISO, Henry Jong-Hyeon Lee, who was newly appointed in August 2025. Our CISO has more than 12 years of experience in the area of information technology and more than 22 years of experience in the area of information protection.

In order to streamline our information protection and privacy governance regime, we operate an integrated security center led by our CISO to prevent common malicious and abusive Internet activities, such as spam, hacking of personal information, distributed

denial-of-service

attacks and dissemination of viruses, worms and other destructive or disruptive software, and to respond in real time when a situation arises. We also hold an Information Protection Committee meeting every week under the leadership of our CISO. Furthermore, key executive officers such as our Chief Operating Officer and Chief Serious-accident Prevention Officer manage company-wide information security risks under the leadership of our Chief Executive Officer.

Board of Directors

Our board of directors is committed to mitigating data privacy and cybersecurity risks and recognizes the importance of these issues as part of our risk management framework. Our board of directors maintains ultimate responsibility for the oversight of our data privacy and cybersecurity program. In addition, our board of directors receives quarterly review reports covering the status of the company’s management and protection of personal credit information from our CISO. For information security issues that have a company-wide impact, our board of directors convenes a crisis response situation room to directly engage with and advise our CISO, and the CISO reports to the board of directors the results of work performed based on such advice. Furthermore, we have established a “red team” under our CISO, which objectively assesses our security status and proposes improvement measures.

ur board of directors’ principal role is one of oversight, recognizing that management is responsible for the design, implementation and maintenance of an effective program for protecting against and mitigating data privacy and cybersecurity risks.

Members of the board of directors stay apprised of the rapidly evolving cyber threat landscape and provide guidance to management as appropriate in order to address the effectiveness of our overall data privacy and cybersecurity program.

Cybersecurity Risk Management Processes Integrated [Flag]

true

Cybersecurity Risk Management Processes Integrated [Text Block]

we operate an integrated security center led by our CISO to prevent common malicious and abusive Internet activities, such as spam, hacking of personal information, distributed

denial-of-service

attacks and dissemination of viruses, worms and other destructive or disruptive software, and to respond in real time when a situation arises.

Cybersecurity Risk Management Third Party Engaged [Flag]

true

Cybersecurity Risk Third Party Oversight and Identification Processes [Flag]

true

Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag]

false

Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Text Block]

our business, financial condition and results of operations have not been materially affected by risks from cybersecurity threats, including as a result of previous cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks and any future material incidents.

Cybersecurity Risk Board of Directors Oversight [Text Block]

Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block]

Cybersecurity Risk Role of Management [Text Block]

Cybersecurity Risk Management Positions or Committees Responsible [Flag]

true

Cybersecurity Risk Management Positions or Committees Responsible [Text Block]

denial-of-service

Cybersecurity Risk Management Expertise of Management Responsible [Text Block]

Our CISO has more than 12 years of experience in the area of information technology and more than 22 years of experience in the area of information protection.

Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block]

Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag]

true