Daijiworld Media Network - Seoul
Seoul, Sep 18: South Korea's fifth-largest credit card company, Lotte Card Co., confirmed on Thursday that a massive data breach last month exposed the personal information of approximately 3 million customers, including critical credit card details of over 280,000 individuals.
The company disclosed that the compromised data — roughly 200 gigabytes — included sensitive information such as identification numbers, internal user IDs, and linking data. More alarmingly, the breach also exposed card numbers, CVV codes, and validity periods, raising serious concerns over the potential for credit card fraud.
The data leak was traced back to a vulnerability in Lotte Card’s online settlement servers, where the information was generated and stored between July 22 and August 27. Despite the scale of the incident, the company said no confirmed cases of fraudulent use have been reported so far.
Lotte Card CEO Cho Jwa-jin publicly apologized for the incident and announced a series of response measures, including full compensation for any customer who suffers losses due to the breach.
"The leaked data cannot be easily used for offline purchases. Additional verification steps are required for online transactions, so unauthorized card usage is not straightforward," Cho said, seeking to downplay fears of immediate misuse.
The company first disclosed the breach earlier this month, prompting an urgent review by the Financial Supervisory Service (FSS), South Korea’s top financial regulator. The incident has since become a major concern for the financial sector, especially following similar breaches in other companies like Seoul Guarantee Insurance.
The breach has also reignited scrutiny over cybersecurity standards in Korea's financial institutions. FSS Governor Lee Chan-jin recently urged all firms in the sector to strengthen their digital defenses and better protect customer information.
Meanwhile, the country’s Science Ministry has launched a separate investigation into a potential data leak at SK Telecom, South Korea's largest mobile carrier. A global hacking group, Scattered Lapsus$, claimed on Telegram that it had obtained SK Telecom’s client data and was offering it for sale at $10,000, with over 40 interested contacts reportedly originating from South Korea.
Additionally, another telecom provider, KT Corp., has reported 278 cases of unauthorized mobile transactions totaling ?170 million (approx. $122,000), raising fresh alarms over possible vulnerabilities in the telecommunications sector as well.
As authorities ramp up efforts to contain the fallout, both the financial and tech sectors in South Korea are facing heightened pressure to shore up their cybersecurity frameworks and restore public confidence.