Lotte Card fined 5 billion won, suspended for 1.5 months over data breach exposing 2.97 million customers

Lotte Card faces a significant penalty after a hacking incident exposed the personal information of nearly 3 million customers. The Financial Services Commission has ordered a 1.5-month suspension of business and imposed a 5 billion won fine. This decision represents the first time a financial institution has been subjected to a business suspension following a data breach caused by hacking.

The commission detailed several security lapses that led to the breach. These included Lotte Card's failure to apply necessary patches to its online payment systems, neglecting to encrypt sensitive data like resident registration numbers and passwords, and not installing antivirus software. These omissions violated current legal security obligations.

The incident came to light in September when Lotte Card reported the hacking and subsequent data leak to financial authorities. The Financial Supervisory Service conducted an inspection, initially proposing a 4.5-month business suspension and a 5 billion won fine. However, the Financial Services Commission adjusted the suspension period after considering factors such as consistency with previous penalty cases, Lotte Card's efforts to mitigate the damage, and the potential impact on the financial market and consumers.