Lotte Card Faces Six-Week Suspension and $3.4M Fine Following Major Data Breach South Korea’s Lotte Card Co., the country’s fifth-largest credit card issuer, has been hit with a six-week suspension on new card issuance and a 5 billion won ($3.4 million) fine after a data breach exposed the personal information of 2.97 million customers. The Financial Services Commission (FSC) imposed the penalties the first business suspension ever levied on a financial firm in South Korea for a hacker-driven data leak marking a significant escalation in regulatory enforcement. The breach, which prompted the FSC’s unprecedented action, underscores growing cybersecurity risks in the financial sector. Meanwhile, Lotte Card’s majority shareholder, North Asia-focused private equity firm MBK Partners, is advancing plans to sell its stake in the company, with a potential deal expected in the first half of 2025. Bidders, including telecom operator KT Corp., are reportedly in early-stage discussions, with MBK seeking over 3 trillion won ($2.5 billion) for its stake nearly double its initial $1.4 billion valuation from its first failed divestment attempt in 2022. The sale process coincides with heightened scrutiny of Lotte Card’s operations following the breach, which may influence investor interest and valuation. The incident also reflects broader regulatory shifts in South Korea, where authorities are tightening oversight of financial institutions’ cybersecurity practices.

Lotte Card, a major South Korean credit card issuer, suffered a significant data breach that exposed the personal information of 2.97 million customers. The incident has triggered widespread consumer anxiety and regulatory scrutiny, particularly as investigations revealed that the company allocated only 0.3% of its annual budget to cybersecurity—the lowest among its peers—despite having one of the highest ratios (15.5%) of IT staff dedicated to information security. The breach underscores systemic vulnerabilities in the credit card industry, where companies collectively spend just 10% of their IT budgets on cybersecurity, leaving critical customer data at risk. The South Korean government is now considering stricter penalties for firms failing to protect against cyberattacks, while lawmakers question whether regulatory oversight itself needs strengthening. The breach has eroded public trust and highlighted the mismatch between security investments and the growing sophistication of cyber threats targeting financial institutions.

Lotte Card Co., South Korea’s fifth-largest card issuer, suffered a major data breach in August 2025, exposing the personal information of 3 million customers, including identification numbers, internal IDs, and connecting data. Among the leaked data (totaling 200 GB), 280,000 customers had critical financial details compromised—card verification codes, card numbers, and validity periods—posing a high risk of credit card fraud. The breach occurred during online settlement processes between July 22 and August 27, though the company claimed offline misuse was unlikely due to additional authentication requirements. CEO Cho Jwa-jin issued a public apology, pledging full compensation for damages. The incident follows a string of cyberattacks in South Korea’s financial sector, raising concerns over cybersecurity vulnerabilities in payment systems. Regulators, including the Financial Supervisory Service, have urged stricter safeguards to prevent future breaches.

A massive customer data leak at Lotte Card (now owned by private equity firm MBK Partners since 2019, despite retaining the 'Lotte' brand) has exposed significant personal information of customers. The breach triggered widespread consumer anger, with many mistakenly blaming Lotte Group—the former parent company—due to persistent brand association. The incident caused substantial reputational damage to Lotte Group, which clarified it holds no managerial control (only a 20% non-participatory stake) and receives no royalties for brand use. The leak reignited debates over Korean corporate practices where companies retain legacy names post-acquisition, leading to misplaced accountability. While no ransomware was involved, the breach involved large-scale customer data exposure, intensifying public distrust and financial risks for the independent entity under MBK Partners.