Lotte Card Co., South Korea’s fifth-largest card issuer, suffered a major data breach in August 2025, exposing the personal information of 3 million customers, including identification numbers, internal IDs, and connecting data. Among the leaked data (totaling 200 GB), 280,000 customers had critical financial details compromised card verification codes, card numbers, and validity periods posing a high risk of credit card fraud. The breach occurred during online settlement processes between July 22 and August 27, though the company claimed offline misuse was unlikely due to additional authentication requirements. CEO Cho Jwa-jin issued a public apology, pledging full compensation for damages. The incident follows a string of cyberattacks in South Korea’s financial sector, raising concerns over cybersecurity vulnerabilities in payment systems. Regulators, including the Financial Supervisory Service, have urged stricter safeguards to prevent future breaches.
Source: https://en.yna.co.kr/view/AEN20250918005851320
TPRM report: https://www.rankiteo.com/company/lotte-card
"id": "lot5362653091825",
"linkid": "lotte-card",
"type": "Breach",
"date": "7/2025",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': '3,000,000 (280,000 with '
'critical payment data exposed)',
'industry': 'financial sector',
'location': 'Seoul, South Korea',
'name': 'Lotte Card Co.',
'size': '9.6 million members',
'type': 'financial services (credit card issuer)'}],
'attack_vector': 'online settlement servers (exploited during online '
'transaction processing)',
'customer_advisories': ['full compensation for damages from improper data '
'use'],
'data_breach': {'data_exfiltration': True,
'number_of_records_exposed': '3,000,000 (280,000 with '
'critical payment data)',
'personally_identifiable_information': True,
'sensitivity_of_data': 'high (payment card data for 280,000 '
'customers; PII for all 3 million)',
'type_of_data_compromised': ['identification numbers',
'internal identification numbers',
'connecting information',
'card verification codes '
'(280,000 customers)',
'card numbers (280,000 '
'customers)',
'card validity periods (280,000 '
'customers)']},
'date_detected': '2025-08-01',
'date_publicly_disclosed': '2025-09-04',
'description': "Lotte Card Co., South Korea's fifth-largest card issuer, "
'disclosed a data breach where personal information of '
'approximately 3 million customers (200 GB of data) was '
'leaked. The breach occurred between July 22 and August 27, '
'2025, via online settlement servers. Compromised data '
'included identification numbers, internal IDs, connecting '
'information, and for 280,000 customers card verification '
'codes, card numbers, and validity periods. The CEO issued a '
'public apology and pledged full compensation for damages, '
'though no improper use of the data has been reported yet. The '
'incident is part of a broader trend of cyber breaches in '
"South Korea's financial sector.",
'impact': {'brand_reputation_impact': 'high (public apology by CEO, press '
'conference with executives bowing; '
'part of a series of financial sector '
'breaches)',
'data_compromised': {'data_volume': '200 GB',
'sensitive_records': '280,000 (card '
'verification codes, '
'card numbers, validity '
'periods)',
'total_records': '3,000,000'},
'identity_theft_risk': 'moderate (identification numbers, internal '
'IDs leaked)',
'payment_information_risk': "high (280,000 customers' card "
'verification codes, numbers, and '
'validity periods exposed)',
'systems_affected': ['online settlement servers']},
'initial_access_broker': {'entry_point': 'online settlement servers',
'high_value_targets': ['payment card data', 'PII']},
'investigation_status': 'ongoing (damage assessment in progress with '
'Financial Supervisory Service)',
'ransomware': {'data_exfiltration': True},
'references': [{'date_accessed': '2025-09-18',
'source': 'Yonhap News Agency'}],
'regulatory_compliance': {'regulatory_notifications': ['Financial Supervisory '
'Service (South Korea) '
'involved in damage '
'assessment']},
'response': {'communication_strategy': ['public apology by CEO (Cho Jwa-jin)',
'press conference with executives',
'media statements'],
'incident_response_plan_activated': True,
'law_enforcement_notified': True,
'remediation_measures': ['full compensation for damages from '
'improper data use']},
'stakeholder_advisories': ['CEO public apology', 'press conference'],
'title': 'Lotte Card Data Breach Affecting 3 Million Customers',
'type': ['data breach', 'cyberattack']}