LG Uplus Randomizes IMSIs, Offers Free USIM Reconfiguration, Adds 5G SUCI Encryption
LG Uplus says it will address long-standing privacy concerns by changing how it issues IMSI numbers, the unique identifiers stored on SIM cards. The carrier plans to begin a voluntary, free USIM reconfiguration or replacement program for customers who opt in, starting on the 13th of next month, with a broader software update in November that will allow IMSI to be changed to random numbers without physical SIM replacement. Separately, the company plans to mandate encrypted IMSI transmission for 5G standalone networks (SA), using a method known as SUCI.
IMSI, a 15-digit number stored on the SIM, serves as a key identifier for mobile networks. According to LG Uplus, it has generated IMSIs by incorporating the subscriber’s actual phone number into the identifier since the 2011 rollout of 4G. In contrast, Korea’s other major operators, SK Telecom and KT, have used randomized or non-number-based identifiers. Experts note that while an IMSI by itself is not enough to launch an attack, its exposure can raise security risks when combined with other data, including the potential for SIM cloning or other forms of unauthorized access.
LG Uplus acknowledges that the early 4G standard did not clearly define IMSI handling, and that the practice of embedding actual numbers persisted. The company argues that the method did not violate regulations, but security practitioners have criticized the long-term retention of identifying data in a predictable form. The move follows heightened public and regulatory attention to data privacy after a high-profile information leak at another carrier last year.
The changes come after government and industry scrutiny. Korea’s Ministry of Science and ICT, the Korea Internet & Security Agency (KISA), and the National Assembly’s Science, ICT, Broadcasting and Communications Committee held two meetings with LG Uplus to discuss safeguards and reforms.
Under LG Uplus’ plan, customers who wish to participate can visit in-store reservation slots to have their USIMs reset or replaced at no charge. The company says it will ensure a smooth process, minimize wait times, and maintain uninterrupted service during the transition. The scope covers all LG Uplus mobile customers, including those using smartwatches or other second devices, kids’ phones, and those on LG Uplus’ MVNO arrangements.
In addition, the 5G standalone (SA) network rollout will require that IMSIs be transmitted in encrypted form rather than in clear text. LG Uplus says SUCI will be applied in full, strengthening privacy protections for users on 5G.
Why this matters beyond Korea: IMSI handling touches on fundamental mobile-security and privacy concerns that affect users, regulators, and operators worldwide. For U.S. readers, the issue highlights ongoing efforts to tighten identity protection as networks migrate to 5G, including stronger protections in 5G SA deployments. The decision may influence how other carriers evaluate IMSI management, SIM replacement policies, and encryption standards, with potential implications for cross-border roaming, device security, and consumer trust in telecommunications infrastructure. It also underscores the broader push among policymakers to align privacy practices with evolving 5G security requirements and to minimize risks associated with long-lived, easily exploitable identifiers in global supply chains and markets.