[2025 Audit] "FSS Conducted 11 Inspections of Lotte Card Over 6 Years... Security Checks Inadequate"

Kang Min-guk: “Neglecting Security Inspections Is Dereliction of Duty”

It has been revealed that financial supervisory authorities conducted 11 inspections of Lotte Card over the past six years but failed to properly examine security issues such as hacking and system failures.

According to data from the office of Kang Min-guk, opposition secretary of the National Assembly’s Political Affairs Committee, received from the Financial Supervisory Service on October 13, there were 67 inspections of eight dedicated credit card companies from 2019 through August of this year. Of these, seven were regular inspections and 60 were ad hoc inspections.

By company, Lotte Card was inspected the most, with 11 inspections.

Kookmin Card and Woori Card each had 10 inspections, Hyundai Card had 9, Shinhan Card and Hana Card each had 8, Samsung Card had 7, and BC Card had 4 inspections.

However, none of the main purposes of these inspections, as disclosed by the Financial Supervisory Service, included examinations related to hacking or security.

Even during the 10 ad hoc inspections of Lotte Card, the focus was on “protecting financial consumers by checking business practices and governance structure,” “reviewing the status of member recruitment,” and “verifying the appropriateness of partnership service operations.”

In the regular inspection conducted over a month starting June 7, 2022, only violations such as improper appointment procedures for audit committee members and breaches of confidentiality in financial transactions were subject to sanctions.

Recently, Lotte Card suffered a hacking incident in which the personal information of 2.97 million people was leaked. Lotte Card had left a vulnerability in its Oracle WebLogic server, which was first reported in 2017, unaddressed for eight years.

Given that the cause of the incident was a weak security system, criticism has arisen that the financial supervisory authorities cannot avoid responsibility.

Kang Min-guk stated, “Failing to conduct inspections related to security vulnerabilities amounts to neglect of duty. Although it is a case of locking the stable door after the horse has bolted, the Financial Supervisory Service must now expand hacking-related inspections conducted on Lotte Card to the entire credit card industry.”

He emphasized, “In particular, if responsibility for the Lotte Card incident is determined, strong measures such as business suspension and punitive fines should be imposed.”

This content was produced with the assistance of AI translation services.