2025 Lotte Card — ~3M customers; PIPC fine; FSC six-week new-customer suspension (Aug–Sep 2026)

Lotte Card, South Korea’s fifth-largest card issuer, confirmed that hackers accessed customer systems in mid-August 2025, exposing personal data for about 3 million customers. The Record and Korean outlets reported identification numbers, internal IDs, and contact information among the stolen fields, with sensitive card numbers, expiry dates, and verification codes also compromised for thousands of customers. Attackers reportedly exploited an unpatched vulnerability on a little-used overseas payments server (fix available since 2017). Detection lagged nearly two weeks. CEO Cho Jwa-jin publicly apologized. PIPC opened a joint probe; later enforcement reporting stated an administrative fine of ₩9.62 billion (~US$6.4M). Aug 2026 regulatory update: Financial Services Commission finalized a six-week business suspension (Aug 1–Sep 15, 2026) barring new credit/debit/prepaid card issuance, plus a ₩5 billion (~US$3.6M) fine — shortened from an FSS-recommended ~4.5-month suspension (UPI / MBK Partners Insider / Seoul Economic Daily). Existing cardholders keep services including lost/expired card replacement. FSC framed the case as the first business suspension for a hacking-related information leak.