Lotte Card Fined 5 Billion Won and Suspended Over Massive Data Breach
Key Takeaways
- •The Financial Services Commission fined Lotte Card 5 billion won and barred new card issuance from August 1 to September 15 over a breach affecting approximately 2.97 million customers.
- •Investigators found that the breach originated from a hack of Lotte Card's online payment system and that the company had failed to implement adequate encryption for its log files.
- •Combined penalties from the FSC and the Personal Information Protection Commission total approximately 14.62 billion won (US$9.9 million), making this one of the most significant data protection enforcement actions against a South Korean financial institution.
- •The business suspension is a relatively rare measure in South Korea's financial sector, reflecting the severity of the breach and the company's insufficient data security practices.
- •The dual penalties illustrate South Korea's overlapping regulatory structure, under which financial regulators and data protection authorities can independently sanction the same incident.
Lotte Card Co. has been hit with 5 billion won (US$3.38 million) in financial penalties and a 1.5-month business suspension following a massive data breach that compromised the personal information of approximately 2.97 million customers, the Financial Services Commission (FSC) announced Friday.
The financial regulator confirmed that Lotte Card will be prohibited from issuing new cards to customers during the suspension period, which runs from August 1 to September 15.
The breach originated from a hack of Lotte Card's online payment system last year. An investigation by the FSC also revealed that the company had failed to implement adequate encryption measures for its log files, leaving sensitive customer data exposed.
This is not the only regulatory action Lotte Card has faced over the incident. Earlier this year, South Korea's data protection watchdog, the Personal Information Protection Commission (PIPC), separately imposed a penalty of 9.62 billion won on the company for violations related to the same data leak. The dual enforcement underscores South Korea's overlapping regulatory structure, in which financial sector regulators and data protection authorities can each independently penalize the same breach under their respective mandates.
Combined, the penalties from both regulators total approximately 14.62 billion won (US$9.9 million), making this one of the most significant enforcement actions against a South Korean financial institution for a data protection failure.
Lotte Card is a subsidiary of the Lotte Group, one of South Korea's largest conglomerates. The FSC's decision to impose a business suspension is a relatively rare measure in South Korea's financial sector, reflecting the severity of the breach and the company's inadequate data security practices. South Korea has been steadily tightening its data protection enforcement framework since the 2014 credit card data leak involving KB Kookmin, Lotte, and NH Card, which exposed tens of millions of records and prompted legislative reforms aimed at holding both companies and executives accountable for lax data security.