ENKR

Lotte Card online-payment server breach

Add to my breach check

Made public · 2,969,000 people

What leaked6

Replaceable

  • Card CVV/CVC
  • Card number
  • Card, bank or site PIN

Hard to replace

  • Other profile data

Permanent

  • Connecting information
  • Resident registration number
  • Card CVV/CVCabout 283,000 people
  • Card numberabout 280,000 per Lotte's briefing
  • Resident registration number450,000 people
  • Card, bank or site PINcard password · two digits per Lotte
  • Other profile datavirtual payment code, internal id, simple-payment service type

To-dos2 · about 20 min in all

  1. Have the card reissued with a new numberabout 15 minStops: card fraud online
  2. Turn on instant transaction alertsabout 5 minHelps you notice: card fraud online

What happened next39 events

  1. Undetected 2 events12 days · show events
  2. Response 21 eventsNotice in 23 days · show events
  3. Remedy 5 eventsEnded · show events
  4. Penalty 11 eventsFine ₩9.6B · Back to latest
  5. DisputesNone on record

Penalty: 11 events

Back to latest
  1. FSS findings: critical patch missing on online payment servers, no web firewall registration, plaintext RRN and passwords in logs, no antivirus; a retired executive notified of violations at reprimand-warning level; three staff (one retired) given suspension- or pay-cut-level sanctions
  2. FSC imposed a 1.5-month partial business suspension · new-member cards, the first for a hacking leak
  3. FSC penalty surcharge of KRW 5 billion under the Credit Information Act
  4. KMCC administrative fine of KRW 11.25 million for failing to safeguard connecting information · CI, about 1.29 million CI leaked
  5. PIPC ordered publication of the sanction on the company website and an overhaul of data protection incl. CPO independence
6 more
  1. PIPC administrative fine of KRW 4.8 million
  2. PIPC penalty surcharge of KRW 9.62 billion for processing RRNs without legal basis and weak encryption
  3. PIPC found resident registration numbers of 450,000 people leaked from plaintext payment logs
  4. PIPC opened an investigation after the FSS passed on the credit-data leak report
  5. FSS and Financial Security Institute began an on-site investigation
  6. National Office of Investigation opened a criminal investigation of the hack
Company
Lotte Card
When it happened
–
Company detected it
Made public
Notice
Leak confirmed
Affected
2,969,000 people · FSC; 283,000 with card password and CVC; 450,000 with RRN · PIPC

How the facts developed

  1. PIPC decision: resident registration numbers of 450,000 people leaked, logged in plaintext; 과징금 96억 2,000만원
  2. 200 GB; 2.969 million people; card password and CVC for about 283,000; card reissue for those at risk of key-in fraud
  3. Reported to the financial authorities; about 1.7 GB estimated at first (press)

Sources