South Korea's Personal Information Protection Commission said Thursday it imposed a fine of 9.62 billion won ($6.8 million) and an additional penalty of 4.8 million won on Lotte Card for a data breach incident.
The commission reached the decision at a plenary meeting held Wednesday, ordering the credit card company to take corrective measures and publish the disciplinary action on its website.
Lotte Card suffered a hacking attack in September last year that exposed personal information of 2.97 million customers. The commission's investigation found that resident registration numbers of 450,000 individuals were also compromised in the breach.
The investigation revealed that Lotte Card violated regulations by storing resident registration numbers and other personal data in plain text within logs related to online payments. The company also failed to implement adequate encryption measures for log files.
The commission noted that log files should contain only minimal personal information when absolutely necessary. However, Lotte Card had been storing resident registration numbers and other sensitive data without proper review, which led to the large-scale breach.
The commission plans to conduct preliminary inspections next month to examine improper practices in the financial sector involving the processing of resident registration numbers without legal basis.
"This incident should serve as a wake-up call for businesses to remain vigilant against misuse and abuse of personal information," a commission official said. "They must regularly review and improve their data handling practices in accordance with privacy protection principles."
