Loading story…
South Korean regulators have notified Lotte Card that it faces about 5 billion won in financial penalties and a business suspension of more than four months after hackers breached the company’s online payment system and exposed personal information belonging to about 2.97 million customers. The notice was issued by the Financial Supervisory Service, with the Financial Services Commission expected to finalize the sanctions.
Investigators found that Lotte Card had also failed to apply sufficient encryption to log files, adding to the severity of the case. The action represents a second major penalty tied to the same incident after the country’s data protection watchdog previously imposed an additional 9.62 billion won fine, underscoring South Korea’s tougher enforcement posture, which can include suspending new customer sign-ups and penalizing executives after major breaches.
See the reporting duties and controls this puts on the clock.
3 events from the most recent confirmed update back to the earliest known activity.
On or before April 9, 2026, the Financial Supervisory Service notified Lotte Card of roughly 5 billion won in additional penalties and a business suspension of more than four months over the same breach. The sanctions were pending finalization by the Financial Services Commission.
South Korea's state data protection watchdog earlier imposed a 9.62 billion won penalty on Lotte Card over the breach. Reports describe this as the first monetary sanction tied to the incident.
Hackers compromised Lotte Card's online payment system in 2025, leading to a large-scale leak of personal information affecting roughly 2.97 million customers. Investigators also found the company had not applied sufficient encryption to log files.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
databreaches.net
Open sourcekoreatimes.co.kr
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
South Korea's Lotte Card suffered a major data breach affecting 3 million customers, with attackers exploiting an unpatched server vulnerability. Exposed data includes identification numbers, contact details, and sensitive card information. The breach has triggered regulatory investigations and scrutiny over the company's cybersecurity investment.
Jun 29, 2026Lotte Card suffered a major data breach affecting 2.97 million users, with over 200GB of data compromised. The breach occurred on the company's online payments server between July 22 and August 27, 2025. Exposed data includes connection information, virtual payment codes, internal IDs, and payment service types.
Jun 29, 2026
South Korea’s Personal Information Protection Commission imposed a record **624.6 billion won** fine on Coupang, plus **248 million won** on subsidiary Coupang Fulfillment Service, after a breach exposed personal data tied to roughly **34 million to 37.55 million people**. Regulators said the incident stemmed from weak security controls, including poor authentication key management and inadequate access restrictions, and that exposed data included names, email addresses, shipping addresses, phone numbers, and order histories. Authorities said the breach began in 2025 and persisted for months before discovery, making it one of the country’s largest retail-sector privacy incidents. The commission also cited Coupang for failures involving data destruction, breach notification, interference with the independence of its data protection officer, and obstruction of the investigation. Investigators identified the main suspect as a former Coupang IT employee, described in one report as a **43-year-old Chinese national**, who allegedly retained sensitive data on multiple hard drives and tried to destroy evidence by discarding a laptop in a river. Coupang said it plans to challenge the penalty, disputed aspects of the exposure, and maintained the stolen data was limited, deleted from recovered devices, and not shared onward.
Jun 29, 2026