South Korea’s largest mobile operator was hit with a fine and stern criticism from the country’s privacy regulator after a cyberattack disclosed in April compromised the data of about half the nation’s population.

The Personal Information Protection Commission on Thursday fined SK Telecom Co 134.8 billion won ($97 million) for failing to protect customer data and not reporting breaches in a timely manner. It also ordered the company to improve oversight and criticized it for a prolonged lapse in securing user data appropriately, with allegations dating back to 2022.

“The company had been in a vulnerable state for quite a long time, with significant weaknesses across the board,” said PIPC Chairman Ko Haksoo. “There were opportunities to identify and address these issues over time, but the company missed those chances and continued to overlook them for a long period. This left the company in a pretty weak and exposed position. The committee members felt a sense of frustration about this.”

READ MORE: Uber to invest US$150m for SK Telecom tie-up in S. Korea

Following an investigation of the attack, the Ministry of Science and ICT in July said the carrier should waive penalties for customers looking to leave the network. PIPC’s decision and commentary adds to pressure on the telecom to reform its practices.

“We regret that our position and actions, which were fully explained during the investigation and deliberation, were not reflected in the outcome,” SK Telecom said, adding that the company will make personal data protection a core value in all its business activities.

While Korean media and public outrage have mostly focused on the risks of ransomware or financial losses from possible personal data theft, lawmaker Yu Yong-weon has raised a broader concern. Yu, a defense and military affairs expert who proposed a National Cybersecurity Act in July, said in an emailed statement this week that the national security implications of the SK Telecom hack are profound.

READ MORE: Metaverse riches lure one of S. Korea’s oldest conglomerates

He said that with access to call data records, hackers could potentially reconstruct entire call logs, exposing sensitive communications at the highest level of the government. The newly proposed National Cybersecurity Act aims to unify the government’s emergency response to cyberattacks and facilitate intelligence sharing on cyber threats.