Lotte Card's business suspension cut from 4.5 months to 1.5 months over data breach

South Korea's financial regulator has handed Lotte Card a 1.5-month business suspension after a hacking incident exposed the personal data of about 3 million customers — a significant reduction from the 4.5-month penalty originally recommended by the Financial Supervisory Service.

The Financial Services Commission held its 14th regular meeting Friday and voted to impose a 1.5-month business suspension and a fine of 5 billion won ($3.47 million) on Lotte Card under the Specialized Credit Finance Business Act and the Credit Information Use and Protection Act.

Financial authorities launched a roughly month-long investigation into the hacking incident after Lotte Card reported the data breach in September last year.

The probe found multiple violations of security obligations under current law in the operation of Lotte Card's online payment system, including failure to apply system patches, failure to encrypt resident registration numbers and passwords, and failure to install antivirus software. Based on those findings, the Financial Supervisory Service held two rounds of its sanctions review committee in April and voted to impose a 4.5-month business suspension, a 5 billion won fine, and a reprimand against former CEO Jo Jwa-jin.

After extensive deliberations — including statements from the company and subcommittee reviews — the Financial Services Commission voted to impose a business suspension on Lotte Card for the first time in connection with a hacking incident, along with the 5 billion won fine for violations of the Credit Information Act. The reprimand against Jo was also confirmed, as disciplinary action against the CEO of a financial firm falls under the sole authority of the FSS governor.

The suspension period was reduced to 1.5 months from the FSS's original recommendation, taking into account fairness with past cases and the company's remediation efforts. Commission members had reportedly raised questions about whether imposing a business suspension for a hacking incident was appropriate. The absence of any precedent abroad for suspending a financial firm's operations over a cyberattack also contributed to the reduction.

Regulators also noted that customers — who bear no responsibility for the breach — should not face inconvenience, and limited the suspension to the issuance of new member cards only. Existing cardholders will be able to apply for and use all card-related services without disruption. The suspension runs from Saturday through Sept. 15.

Financial authorities said they will pursue regulatory reforms to fundamentally strengthen the security management frameworks of financial firms and prevent a recurrence of such data breaches.

To sharpen awareness of security violations among financial institutions, regulators plan to support passage through the National Assembly of an amendment to the Electronic Financial Transactions Act. The amendment would introduce punitive fines — capped at 3 percent of total revenue — for serious security incidents, and would expand the authority of chief information security officers to lead security improvements.

Although the penalty came in lighter than initially expected, Lotte Card still faces a meaningful operational burden given its need to actively grow its membership base. MBK Partners, Lotte Card's largest shareholder, has been pursuing a sale of the company for an extended period.

In response to the Financial Services Commission's decision, Lotte Card issued a statement Friday saying it "humbly accepts the decision" and offering "a sincere apology to our customers for the concern this incident has caused." The company added that the suspension "applies only to a portion of new business activities and will have no impact on existing members' use of services."

Lotte Card also said it "will redouble efforts across all necessary measures, including information security, to ensure such an incident does not recur and to rebuild trust as a reliable financial institution."