Cybersecurity Policy Report, South Korea Fines Credit Card Provider Over Data Breach, (Mar 13, 2026)

By Tony Foley

The South Korean Personal Information Protection Commission (PIPC) announced yesterday that it had fined credit card company Lotte Card Ltd. 9.62 billion won ($6.4 million) and imposed an additional sanction of 4.8 million won ($3,200) based on violations of the Personal Information Protection Act (PIPA) in connection with a 2022 data breach.

In a press release announcing the sanctions, PIPC said it launched an in September 2022 after Lotte Card was informed by the Financial Supervisory Service of a report of personal credit information leakage. A subsequent investigation confirmed that the personal credit information of about 2.97 million users recorded in log files was leaked due to a hack of Lotte Card’s simple payment system, and the resident registration numbers of 450,000 users also were leaked.

The press release noted a distinction between requirements in the PIPA vis-à-vis the Act on the Use and Protection of Credit Information, a special law on the processing of personal credit information that takes precedence over the PIPA. The agency said financial authorities investigated whether Lotte Card violated the Credit Information Act with respect to its obligation to take safety measures related to the leakage of personal credit information, and the PIPC investigated whether the company violated the PIPA in connection with the company’s handling of resident registration numbers.

The PIPC’s decision, which may be downloaded from the press release but is available only in Korean, found that Lotte Card processed the resident registration numbers beyond the scope permitted by the PIPA, including by recording a large amount of personal information. Additionally, the agency said, Lotte Cards did not take sufficient measures to encrypt log files, and one reason for the hack was because the company stored personal information without a separate review, even though only the minimum amount of personal information should be recorded in the log file, and only in unavoidable cases.

In addition to the monetary sanctions, the PIPC ordered Lotte Cards to check and improve the overall status of personal information processing and to improve its overall personal information protection system, including strengthening the responsibility and independence of data protection officers.

News: InternationalLegislation LitigationEnforcement DataSecurity DataBreach