According to Yonhap News Agency, Lotte Card confirmed that a hacking incident resulted in the exposure of personal data belonging to approximately 2.97 million customers [1]. Reports stated that roughly 200 GB of data was exfiltrated from online payment-related servers between approximately August 14 and August 27, 2025 [2]. Reports also noted that sensitive fields such as card numbers for a subset of customers may have been affected, while any confirmed fraudulent transactions remain subject to the original source text [3].
This event has not been officially confirmed. Content is based on media or third-party reports.
Backfill: this event became public on Sep 18, 2025 and we added it on Nov 10, 2026. It is not a new event.
CriticalMonitoringBackfillMedia reported
South Korean Media Cites Lotte Card Confirming Data Breach Affecting Approximately 2.97 Million Customers
1 min read
- Disclosed
- Sep 18, 2025
- Occurred
- Aug 14, 2025
- Published
- Nov 10, 2026
- Last updated
- Nov 7, 2026
- Scale
- 2,970,000 people[1]
- CVSS basis
- Our assessment
- Attack vector
- Impact
- Data type
- Actor type
- Motivation
On this page
30-second summary
What happened
Who is affected
Industries mainly affected: Finance
What to do nowOur advice
Reports also noted that sensitive fields such as card numbers for a subset of customers may have been affected, while any confirmed fraudulent transactions remain subject to the original source text [3].
Timeline
- Incident publicly disclosed[1]
Technical details
Source-Supported Details
Yonhap News Agency, The Korea Herald, and Korea JoongAng Daily cited Lotte Card's public statements confirming that its online payment server was breached and data of approximately 2.97 million customers was exposed. Affected counts in this entry reflect only verifiable figures from the original sources [1].
Source excerpt: "(서울=연합뉴스) 서대연 기자 = 조좌진 롯데카드 대표이사 등 관계자들이 18일 서울 중구 부영태평빌딩에서 해킹 사고로 인한 고객 정보 유출사태에 대해 대고객 사과를 하고 있다. 2025.9.18 dwise@yna.co.kr" [1].
Source excerpt: "Investigations found that lax cybersecurity management worsened the breach. Attackers first scanned the payments server for vulnerabilities on Aug. 12, installed malicious code the next day and exfiltrated 1.7 gigabytes of data on Aug. 14 and 15." [2].
Source excerpt: "Make us preferred on Google Audio report: written by reporters, read by AI Lotte Card CEO Cho Jwa-jin and other company executives bow in apology during a press conference held in Jung District, central Seoul on Sept." [3].
References
Media3
- [1]
“(서울=연합뉴스) 서대연 기자 = 조좌진 롯데카드 대표이사 등 관계자들이 18일 서울 중구 부영태평빌딩에서 해킹 사고로 인한 고객 정보 유출사태에 대해 대고객 사과를 하고 있다. 2025.9.18 dwise@yna.co.kr”
- [2]
This site aggregates public information and is not security consulting advice. Test remediation steps before applying.