GSMs vulnerabilities have been known a long time now. UMTS was supposed to fix those problems. Why is GSM still used?
In order to make a cellphone tower UMTS-capable, various hardware upgrades need to be made to it. This costs money. For that reason, many cellphone towers, especially in rural areas, have not been upgraded yet.
As long as there is not near-100% UMTS coverage, cellphones will still need to support a pure GSM connection to ensure that the user has connectivity in areas where no UMTS is available yet.
This started as a comment reply to @user10008 but got too long...
Even after the towers are all upgraded, the carriers can't immediately switch off 2g service for a number of reasons. The biggest issue there is that not everyone upgrades their phone frequently; in particular this is true of people who use it as just-a-phone or an emergency-use-only-phone.
There are also commercial/industrial embedded systems that use the cellular network to report home. Low bandwidth devices like monitoring systems, ATMs, or credit card readers have no need for high speed data and no reason for the owners to upgrade frequently. AFAIK they typically have SLAs with carriers to guarantee longer term operation than the standard 2 year consumer contract.
Regulatory issues can also be involved. In the US, you're not allowed to turn off a voice network without giving customers free new phones without contract extensions. As a result, the major US carriers have scheduled 2017-21 sunset dates for 2g service to give as much time as possible for the long tail to upgrade on their own. That said, the carriers probably will refarm all but a tiny sliver of their 2g spectrum to 4g (5g?) prior to the shutdown to maximize utilization rates. When the finally do force the issue and shut down their 2g network, they probably will end up having significant numbers of customers who were coasting month to month due to apathy shop around and decide to change carriers.
When Sprint shutdown the iDEN (2g with no upgrade path) network they inherited from the Nextel acquisition; they suffered heavy customer attrition in the final months from people deciding to switch carriers instead of taking a free replacement. IIRC the loss rate for the final few months was >50% of the remainder and several hundred thousand customers in total.
GSM is cheap and good for land with many water bodies, say like small islands and so on. Cheaper goods sell in large populations and Asia got covered by GSM before the CDMA tried its best.
CDMA is good in contiguous land area. The sound quality is much better. But royalty has to be payed to Qualcomm who developed CDMA. Hence the technology, subscriber connection and handsets all became costly while adoption rate was low.
UMTS came as GSM upgrade. But needed various upgrades across the board, manufacturing, chipsets, handsets, towers, software all had to be upgraded. The adoption of GSM by large population pre-empts the case where everybody uses only UMTS
I read this answer in some book.
Many existing GSM networks are in the process of being shutdown -- AT&T has already announced a year or two ago about its plans to shutdown its GSM network completely by the end of 2016. As others mentioned, migration and shutdown takes time, since both the towers and the end-user equipment must be upgraded.
Some latecomer mobile operators have likewise never even had any GSM networks in the first place -- three.co.uk, windmobile.ca, mobilicity.ca -- all have started out after UMTS was already available, and have never deployed GSM, going straight to UMTS.
Another matter is that a lot of people incorrectly refer to these UMTS operators as "GSM", where you might be led to believe that you'd be getting onto a GSM network with Wind Mobile, for example, whereas their network is 100% UMTS (apart from roaming agreements with legacy operators, which are still running their GSM networks for legacy users).
Also consider that all leftover GSM networks in the whole world run on a set of like 4 bands in total, whereas the number of bands for UMTS and LTE is so plentiful that even experienced users would have to triple-check the specs of each phone against the full set of the bands utilised by the operator to ensure maximum coverage and compatibility. This is especially important for M2M applications (like, say, cars), where you want to keep the costs to an absolute minimum, and life cycle may be quite long.
Also, some countries, like Japan, have long as completely shut down their 2G networks.