South Korean Regulators Suspend Lotte Card After Massive Data Breach
Lotte Card faces a six-week ban on new card issuance and a 5 billion won fine after leaking data of nearly 3 million customers.
South Korean financial regulators have imposed a six-week suspension on new card issuance and a 5 billion won ($3.4 million) fine on Lotte Card Co. following a massive data breach. This marks the first time a South Korean financial institution has faced a business suspension due to a hacker-driven information leak.
The breach exposed the personal information of 2.97 million customers, representing approximately 30% of Lotte Card's total customer base. The scale of the leak was far more severe than the company initially disclosed; while Lotte Card first reported 1.7 gigabytes of lost data to regulators, the actual volume was 200 gigabytes. Among the affected users, approximately 280,000 individuals had highly sensitive credit data leaked, including resident registration numbers, card numbers, and CVC codes.
Lotte Card is majority-owned by MBK Partners, a North Asia-focused private equity firm that acquired a 79.83% stake in the company in 2019. The firm has already faced controversy regarding its ownership of other entities, such as Homeplus, and this security failure has intensified political pressure. The incident has led to calls for the National Assembly to summon MBK chairperson Kim Byung-ju for an official audit.
The severity of the penalty—specifically the operational suspension—sets a significant regulatory precedent for cybersecurity failures within South Korea's financial sector. The case highlights a growing tension between the private equity ownership model and the stringent security requirements necessary for critical financial infrastructure. This regulatory crackdown may complicate MBK Partners' eventual strategy to exit its investment in Lotte Card.
Lotte Card CEO Cho Jwa-jin has issued a public apology, stating he takes responsibility for the anxiety caused to customers and pledging that the company will reimburse 100 percent of any losses stemming from the incident. Observers are now watching whether the National Assembly will proceed with the summons of MBK leadership and if further financial penalties will be levied as the full scope of the breach is analyzed.