South Korea fines Lotte Card 9.62 billion won over data breach; disclosure ordered

The Personal Information Protection Commission (PIPC) of South Korea announced penalties against Lotte Card for a data breach, totaling 9.62 billion won in fines plus 480,000 won in an administrative penalty, after a plenary meeting held yesterday. The agency also ordered corrective actions and required Lotte Card to publish details of the disciplinary action on its website.

The breach occurred in September last year when an external hacking attack exposed the personal data of 2.97 million customers. Investigators found that 450,000 resident registration numbers were among the leaked data.

The PIPC found that Lotte Card processed resident registration numbers in online-payment related logs in plaintext, violating its own privacy rules; log files were not encrypted adequately.

The logs contained more personal data than necessary, and Lotte Card stored many items without proper review, which the agency said contributed to the scale of the breach.

The PIPC said it will seek to examine financial-sector practices of handling resident registration numbers without a legal basis, through a preventive survey planned for next month.

This case matters beyond Korea because it highlights global concerns about data security in financial services, especially in the context of cross-border data flows, compliance costs for multinational firms, and the risk of large fines for lax data protection—issues relevant to U.S. banks, fintechs, and investors with Korean exposure.

Context: Lotte Card is a major Korean credit-card issuer. Korea has a stringent privacy regime that requires encryption and minimization of personal data in logs, and the PIPC enforces penalties when rules are violated. The requirement to disclose disciplinary actions on a company site reflects a push toward transparency.