ENKR

Lotte Card online-payment server breach

Add to my breach check

Made public · 2,969,000 people

What leaked6

Replaceable

  • Card CVV/CVC
  • Card number
  • Card, bank or site PIN

Hard to replace

  • Other profile data

Permanent

  • Connecting information
  • Resident registration number
  • Card CVV/CVCabout 283,000 people
  • Card numberabout 280,000 per Lotte's briefing
  • Resident registration number450,000 people
  • Card, bank or site PINcard password · two digits per Lotte
  • Other profile datavirtual payment code, internal id, simple-payment service type

To-dos2 · about 20 min in all

  1. Have the card reissued with a new numberabout 15 minStops: card fraud online
  2. Turn on instant transaction alertsabout 5 minHelps you notice: card fraud online

What happened next39 events

  1. Undetected 2 events12 days · show events
  2. Response 21 eventsNotice in 23 days · show events
  3. Remedy 5 eventsEnded · show events
  4. Penalty 11 eventsFine ₩9.6B · show events
  5. DisputesNone on record
  1. Half-year report: 13 damages suits over the leak pending as of end-June 2026, claims totalling KRW 3.70 billion
  2. New-member credit, prepaid and debit card recruitment suspended until September 15, 2026 under the FSC order
  3. Company accepted the FSC decision and apologised to customers
  4. DART material-event report of the business suspension · affected 2025 revenue KRW 66.07 billion; KRW 8.26 billion for 1.5 months
  5. FSS findings: critical patch missing on online payment servers, no web firewall registration, plaintext RRN and passwords in logs, no antivirus; a retired executive notified of violations at reprimand-warning level; three staff (one retired) given suspension- or pay-cut-level sanctions
34 more
  1. FSC imposed a 1.5-month partial business suspension · new-member cards, the first for a hacking leak
  2. FSC penalty surcharge of KRW 5 billion under the Credit Information Act
  3. KMCC administrative fine of KRW 11.25 million for failing to safeguard connecting information · CI, about 1.29 million CI leaked
  4. New CEO appointed by the shareholders' meeting and board, term from March 16, 2026
  5. PIPC ordered publication of the sanction on the company website and an overhaul of data protection incl. CPO independence
  6. PIPC administrative fine of KRW 4.8 million
  7. PIPC penalty surcharge of KRW 9.62 billion for processing RRNs without legal basis and weak encryption
  8. PIPC found resident registration numbers of 450,000 people leaked from plaintext payment logs
  9. The CEO announced his resignation effective December 1, 2025, taking responsibility for the breach
  10. Five senior executives, including four division heads, resigned; reorganisation
  11. PIPC opened an investigation after the FSS passed on the credit-data leak report
  12. FSC: no fraudulent card payments confirmed so far, and none reported to Lotte Card's customer centre
  13. KRW 110 billion of security investment over five years announced, raising the security share of the budget to 15%
  14. 24-hour incident call centre staffed up; security menu added to the app home screen
  15. Reissue texts and calls to the 280,000 customers whose leaked card data could be misused
  16. Offered free card-use alerts or Credit Care (financial-loss cover) to affected customersEnded December 31, 2025
  17. Next year's annual fee waived without limit for the 280,000 priority-reissue customers who reissue
  18. Offered 10-month interest-free instalments on any amount to all affected customersEnded December 31, 2025
  19. Said it would fully compensate damage, including secondary damage once linked to the leak
  20. Online lookup for whether and which items of one's data leaked
14 more
  1. Press briefing with an account of the breach and a public apology
  2. Website notice of the credit-data leak covering online payments from July 22, 2025 to August 27, 2025
  3. Individual notices to affected customers began
  4. Formal report to the FSC and FSS: 200 GB leaked, credit data of 2.969 million people, card password and CVC for about 283,000
  5. Company confirmed that many customers' personal credit data had leaked
  6. Extra authentication for higher-risk customers; password change, overseas-payment blocking and card reissue support
  7. Full advance compensation promised for fraudulent use caused by the breach
  8. FSS and Financial Security Institute began an on-site investigation
  9. National Office of Investigation opened a criminal investigation of the hack
  10. First public notice of the intrusion
  11. Breach reported to the FSC and FSS as an estimated 1.7 GB leak
  12. Traces of an attempt to exfiltrate data found on the online payment server
  13. Malware found on some servers during an internal server check
  14. Intrusion began
Company
Lotte Card
When it happened
–
Company detected it
Made public
Notice
Leak confirmed
Affected
2,969,000 people · FSC; 283,000 with card password and CVC; 450,000 with RRN · PIPC

How the facts developed

  1. PIPC decision: resident registration numbers of 450,000 people leaked, logged in plaintext; 과징금 96억 2,000만원
  2. 200 GB; 2.969 million people; card password and CVC for about 283,000; card reissue for those at risk of key-in fraud
  3. Reported to the financial authorities; about 1.7 GB estimated at first (press)

Sources