Lotte Card Faces Six-Week Suspension and $3.4M Fine Following Major Data Breach
South Korea’s Lotte Card Co., the country’s fifth-largest credit card issuer, has been hit with a six-week suspension on new card issuance and a 5 billion won ($3.4 million) fine after a data breach exposed the personal information of 2.97 million customers. The Financial Services Commission (FSC) imposed the penalties the first business suspension ever levied on a financial firm in South Korea for a hacker-driven data leak marking a significant escalation in regulatory enforcement.
The breach, which prompted the FSC’s unprecedented action, underscores growing cybersecurity risks in the financial sector. Meanwhile, Lotte Card’s majority shareholder, North Asia-focused private equity firm MBK Partners, is advancing plans to sell its stake in the company, with a potential deal expected in the first half of 2025. Bidders, including telecom operator KT Corp., are reportedly in early-stage discussions, with MBK seeking over 3 trillion won ($2.5 billion) for its stake nearly double its initial $1.4 billion valuation from its first failed divestment attempt in 2022.
The sale process coincides with heightened scrutiny of Lotte Card’s operations following the breach, which may influence investor interest and valuation. The incident also reflects broader regulatory shifts in South Korea, where authorities are tightening oversight of financial institutions’ cybersecurity practices.
Source: https://www.kedglobal.com/regulations/newsView/ked202607310008
Lotte Card cybersecurity rating report: https://www.rankiteo.com/company/lotte-card
"id": "LOT1785500929",
"linkid": "lotte-card",
"type": "Breach",
"date": "6/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': '2.97 million',
'industry': 'Credit Card Issuer',
'location': 'South Korea',
'name': 'Lotte Card Co.',
'type': 'Financial Institution'}],
'data_breach': {'number_of_records_exposed': '2.97 million',
'personally_identifiable_information': 'Yes',
'sensitivity_of_data': 'High (personally identifiable '
'information)',
'type_of_data_compromised': 'Personal information'},
'description': 'Lotte Card Co., South Korea’s fifth-largest credit card '
'issuer, faced a six-week suspension on new card issuance and '
'a 5 billion won ($3.4 million) fine after a data breach '
'exposed the personal information of 2.97 million customers. '
'This marks the first business suspension ever levied on a '
'financial firm in South Korea for a hacker-driven data leak.',
'impact': {'brand_reputation_impact': 'Heightened scrutiny and potential '
'impact on investor interest',
'data_compromised': 'Personal information of 2.97 million '
'customers',
'downtime': 'Six-week suspension on new card issuance',
'financial_loss': '5 billion won ($3.4 million) fine',
'identity_theft_risk': 'Exposure of personal information',
'operational_impact': 'Suspension of new card issuance'},
'references': [{'source': 'Financial Services Commission (FSC)'}],
'regulatory_compliance': {'fines_imposed': '5 billion won ($3.4 million)',
'legal_actions': 'Six-week suspension on new card '
'issuance'},
'title': 'Lotte Card Data Breach and Regulatory Penalties',
'type': 'Data Breach'}