ENKR

Lotte Card online-payment server breach

Add to my breach check

Made public · 2,969,000 people

What leaked6

Replaceable

  • Card CVV/CVC
  • Card number
  • Card, bank or site PIN

Hard to replace

  • Other profile data

Permanent

  • Connecting information
  • Resident registration number
  • Card CVV/CVCabout 283,000 people
  • Card numberabout 280,000 per Lotte's briefing
  • Resident registration number450,000 people
  • Card, bank or site PINcard password · two digits per Lotte
  • Other profile datavirtual payment code, internal id, simple-payment service type

To-dos2 · about 20 min in all

  1. Have the card reissued with a new numberabout 15 minStops: card fraud online
  2. Turn on instant transaction alertsabout 5 minHelps you notice: card fraud online

What happened next39 events

  1. Undetected 2 events12 days · Back to latest
  2. Response 21 eventsNotice in 23 days · show events
  3. Remedy 5 eventsEnded · show events
  4. Penalty 11 eventsFine ₩9.6B · show events
  5. DisputesNone on record

Undetected: 2 events

Back to latest
  1. Malware found on some servers during an internal server check
  2. Intrusion began
Company
Lotte Card
When it happened
–
Company detected it
Made public
Notice
Leak confirmed
Affected
2,969,000 people · FSC; 283,000 with card password and CVC; 450,000 with RRN · PIPC

How the facts developed

  1. PIPC decision: resident registration numbers of 450,000 people leaked, logged in plaintext; 과징금 96억 2,000만원
  2. 200 GB; 2.969 million people; card password and CVC for about 283,000; card reissue for those at risk of key-in fraud
  3. Reported to the financial authorities; about 1.7 GB estimated at first (press)

Sources