Lotte Card, a major South Korean credit card issuer, suffered a significant data breach that exposed the personal information of 2.97 million customers. The incident has triggered widespread consumer anxiety and regulatory scrutiny, particularly as investigations revealed that the company allocated only 0.3% of its annual budget to cybersecurity—the lowest among its peers—despite having one of the highest ratios (15.5%) of IT staff dedicated to information security. The breach underscores systemic vulnerabilities in the credit card industry, where companies collectively spend just 10% of their IT budgets on cybersecurity, leaving critical customer data at risk. The South Korean government is now considering stricter penalties for firms failing to protect against cyberattacks, while lawmakers question whether regulatory oversight itself needs strengthening. The breach has eroded public trust and highlighted the mismatch between security investments and the growing sophistication of cyber threats targeting financial institutions.

Lotte Card Co., South Korea’s fifth-largest card issuer, suffered a major data breach in August 2025, exposing the personal information of 3 million customers, including identification numbers, internal IDs, and connecting data. Among the leaked data (totaling 200 GB), 280,000 customers had critical financial details compromised—card verification codes, card numbers, and validity periods—posing a high risk of credit card fraud. The breach occurred during online settlement processes between July 22 and August 27, though the company claimed offline misuse was unlikely due to additional authentication requirements. CEO Cho Jwa-jin issued a public apology, pledging full compensation for damages. The incident follows a string of cyberattacks in South Korea’s financial sector, raising concerns over cybersecurity vulnerabilities in payment systems. Regulators, including the Financial Supervisory Service, have urged stricter safeguards to prevent future breaches.

A massive customer data leak at Lotte Card (now owned by private equity firm MBK Partners since 2019, despite retaining the 'Lotte' brand) has exposed significant personal information of customers. The breach triggered widespread consumer anger, with many mistakenly blaming Lotte Group—the former parent company—due to persistent brand association. The incident caused substantial reputational damage to Lotte Group, which clarified it holds no managerial control (only a 20% non-participatory stake) and receives no royalties for brand use. The leak reignited debates over Korean corporate practices where companies retain legacy names post-acquisition, leading to misplaced accountability. While no ransomware was involved, the breach involved large-scale customer data exposure, intensifying public distrust and financial risks for the independent entity under MBK Partners.