'Lotte Card Fights to Retain Members Amid Business Suspension... Ramps Up Information Security'

If Lotte Card Fails to Sustain Membership Growth,
Its Competitive Edge in Credit Sales May Weaken
A Chain Reaction of 'Declining Net Profit → Eroded Corporate Value'
Lotte Card: "We Will Prioritize Stability and Profitability"

On July 31, Lotte Card announced that it has received a 1.5-month business suspension and a 5 billion KRW penalty from the Financial Services Commission. The company stated that until the business suspension is lifted on September 15, it will mobilize all corporate resources to prevent member attrition. Regarding a potential administrative lawsuit, the company has not yet made a concrete decision and emphasized that maintaining the company’s stability and profitability would remain its top priority.

The Recovery in Membership and Performance Faces a Setback

Lotte Card has become the first financial institution to be suspended over a hacking incident. The company experienced a decline in customer numbers and recorded losses after the incident, but had shown rapid recovery in both member management and financial performance. However, the latest sanction prevents the company from processing new memberships for 45 days, which is expected to have an unavoidable impact on its core credit sales business.

According to the Credit Finance Association, in the 11 months following the hacking incident in August last year, Lotte Card averaged 86,000 account closures and 77,000 new memberships per month. In September last year, immediately after the incident, the number of account closures surged by 139% to 160,000, up from 67,000 in the previous month, but then stabilized at around 70,000 to 90,000 per month. By the end of February this year, closures had returned to the pre-incident level of 69,000. New memberships declined to 73,000 in September last year, a 13.1% (11,000 persons) decrease from the previous month's 84,000, but rebounded to normal levels by the end of January this year (92,000).

Net profit has also rebounded. Based on equity attributable to the controlling shareholder, the company posted a net loss of 2.87 billion KRW in the fourth quarter last year right after the incident, but reported a net profit of 2.06 billion KRW in the first quarter of this year, up 44.1% from 1.43 billion KRW year-on-year. Just as Lotte Card appeared to be making a swift return to normal operations, the new sanction has once again disrupted this recovery process.

Full Effort to Prevent a Repeat of the '10% Membership Drop'

Lotte Card plans to focus its resources on minimizing customer attrition during the suspension period.

Previously, after a three-month business suspension due to a customer data breach in 2014, Lotte Card saw its customer base shrink by 10% within a year. The company then lost 850,000 members compared to the end of 2013 (8.08 million members), and its net profit fell by 4.5 billion KRW (3%) from 151.9 billion KRW to 147.4 billion KRW during that period. In addition, then-CEO Park Sang-hoon and eight other executives offered their resignations.

The current sanctions are less severe than those in 2014; however, given that the business environment for credit cards has deteriorated since then, managing member numbers is expected to be much more challenging. During the suspension, issuing new credit, debit, and prepaid cards to new members will be prohibited. However, exceptions apply for cards for public purposes, existing members may get replacement cards, and existing customers are allowed to apply for and expand the limits of products such as card loans, cash advances, and revolving credit.

Financial industry sources believe that if Lotte Card fails to manage its core credit sales and membership, it could lead to a rapid drop in net profit, thereby reducing the company’s overall value. There are also concerns about workforce attrition due to staff discontent and weakening momentum in new business initiatives. The market valuation of Lotte Card, once estimated at 3 trillion KRW, has since fallen to the 2 trillion KRW range, and some expect it could drop to the 1 trillion KRW range going forward.

Strengthening Information Security to Prevent Recurrence

Lotte Card will bolster information security, led by CEO Chung Sangho and the Financial Consumer Protection Committee, to thoroughly prevent any recurrence. Immediately after his inauguration in March this year, CEO Chung restructured the organization by elevating the Information Security Office, formerly under the Strategy Division, to a direct Information Security Center under the CEO led by a Chief Information Security Officer (CISO).

CEO Chung presented to the Financial Services Commission agenda subcommittee the measures implemented to protect consumers following the incident. Currently, Lotte Card is promoting (1) the establishment of a Financial Consumer Protection Committee—consisting of four members including the CEO—within the Board of Directors, (2) an increase of the information security budget to account for 15% of the total IT budget, and (3) a planned investment of 120 billion KRW in information security over the next five years.

The Financial Services Commission also announced that it would actively support the passage of the amended Electronic Financial Transaction Act at the National Assembly. The amendment stipulates that, in the event of a major security breach, punitive fines of up to 3% of a financial institution’s total sales can be enforced, and that the CISO’s authority will be strengthened so that the CISO can take the lead in establishing security measures.

Delinquency Rate Approaches 2%... Strengthening Financial Soundness Remains a Priority

In parallel, Lotte Card intends to focus on financial soundness, including tighter management of delinquency rates. As of the end of the first quarter, Lotte Card’s one-month-or-more delinquency ratio—or effective overdue rate—stood at 1.84%, down 0.38 percentage points from 2.22% at the end of the third quarter last year right after the incident. However, the company’s asset soundness is still seen as weaker than the industry average.

A Lotte Card spokesperson said, “We humbly accept the regulator’s decision and sincerely apologize to our customers for the concerns caused by this incident. We will do our utmost to become a trusted financial institution by strengthening information security and taking all necessary measures to prevent a recurrence.”

The spokesperson added, “No specific decision has been made regarding administrative litigation. For now, our top priority is maintaining the company’s stability and profitability under current conditions.”

This content was produced with the assistance of AI translation services.