Data Breach Affects Nearly 3 Million Lotte Card Customers, No Reports of Misuse Yet


Seoul: Lotte Card Co., the country’s fifth-largest card issuer, has revealed that personal data of approximately 3 million customers was leaked during a hacking incident last month. However, as of now, there have been no reports of the data being misused.



According to Yonhap News Agency, the breached data, which amounts to approximately 200 gigabytes, includes identification numbers, internal identification numbers, and connecting information. Furthermore, sensitive information such as card verification codes, card numbers, and card validity periods for around 280,000 customers was also compromised, posing potential risks of credit card fraud.



Lotte Card CEO Cho Jwa-jin has publicly apologized for the breach and detailed response measures, including offering full compensation for any reported damages stemming from misuse of the stolen data. He explained that the data was compromised during the online settlement process on servers between July 22 and August 27. Cho emphasized that offline settlements are not at risk and that online transactions require additional identification, making misuse challenging with only the breached data.



Earlier this month, Lotte Card, which boasts approximately 9.6 million members, disclosed the cyber incident. Since the disclosure, both the financial watchdog and the company have been working to assess the extent of the damage caused. The data breach is the latest in a series of significant cybersecurity incidents in the financial sector, following a similar breach at Seoul Guarantee Insurance.



This cybersecurity lapse occurs amid calls from Financial Supervisory Service Governor Lee Chan-jin for financial firms to enhance their cybersecurity measures to better protect customer information. The country’s financial regulator has promised stringent actions against any regulatory breaches by Lotte Card and has warned of imposing the highest-ever penalty if a serious violation is found. Additionally, the Financial Services Commission has announced plans to review the cybersecurity status across the financial sector.