ENKR

Lotte Card online-payment server breach

Add to my breach check

Made public · 2,969,000 people

What leaked6

Replaceable

  • Card CVV/CVC
  • Card number
  • Card, bank or site PIN

Hard to replace

  • Other profile data

Permanent

  • Connecting information
  • Resident registration number
  • Card CVV/CVCabout 283,000 people
  • Card numberabout 280,000 per Lotte's briefing
  • Resident registration number450,000 people
  • Card, bank or site PINcard password · two digits per Lotte
  • Other profile datavirtual payment code, internal id, simple-payment service type

To-dos2 · about 20 min in all

  1. Have the card reissued with a new numberabout 15 minStops: card fraud online
  2. Turn on instant transaction alertsabout 5 minHelps you notice: card fraud online

What happened next39 events

  1. Undetected 2 events12 days · show events
  2. Response 21 eventsNotice in 23 days · Back to latest
  3. Remedy 5 eventsEnded · show events
  4. Penalty 11 eventsFine ₩9.6B · show events
  5. DisputesNone on record

Response: 21 events

Back to latest
  1. Half-year report: 13 damages suits over the leak pending as of end-June 2026, claims totalling KRW 3.70 billion
  2. New-member credit, prepaid and debit card recruitment suspended until September 15, 2026 under the FSC order
  3. Company accepted the FSC decision and apologised to customers
  4. DART material-event report of the business suspension · affected 2025 revenue KRW 66.07 billion; KRW 8.26 billion for 1.5 months
  5. New CEO appointed by the shareholders' meeting and board, term from March 16, 2026
16 more
  1. The CEO announced his resignation effective December 1, 2025, taking responsibility for the breach
  2. Five senior executives, including four division heads, resigned; reorganisation
  3. FSC: no fraudulent card payments confirmed so far, and none reported to Lotte Card's customer centre
  4. KRW 110 billion of security investment over five years announced, raising the security share of the budget to 15%
  5. 24-hour incident call centre staffed up; security menu added to the app home screen
  6. Reissue texts and calls to the 280,000 customers whose leaked card data could be misused
  7. Online lookup for whether and which items of one's data leaked
  8. Press briefing with an account of the breach and a public apology
  9. Website notice of the credit-data leak covering online payments from July 22, 2025 to August 27, 2025
  10. Individual notices to affected customers began
  11. Formal report to the FSC and FSS: 200 GB leaked, credit data of 2.969 million people, card password and CVC for about 283,000
  12. Company confirmed that many customers' personal credit data had leaked
  13. Extra authentication for higher-risk customers; password change, overseas-payment blocking and card reissue support
  14. First public notice of the intrusion
  15. Breach reported to the FSC and FSS as an estimated 1.7 GB leak
  16. Traces of an attempt to exfiltrate data found on the online payment server
Company
Lotte Card
When it happened
–
Company detected it
Made public
Notice
Leak confirmed
Affected
2,969,000 people · FSC; 283,000 with card password and CVC; 450,000 with RRN · PIPC

How the facts developed

  1. PIPC decision: resident registration numbers of 450,000 people leaked, logged in plaintext; 과징금 96억 2,000만원
  2. 200 GB; 2.969 million people; card password and CVC for about 283,000; card reissue for those at risk of key-in fraud
  3. Reported to the financial authorities; about 1.7 GB estimated at first (press)

Sources