The financial authorities are set to reach a conclusion on sanctions against Lotte Card following the hacking incident after more than a year. If the proposed sanction level is approved, Lotte Card is expected to lose hundreds of thousands of members. Combined with deteriorating funding costs, the company’s foundation could be significantly shaken. Financial institutions that have suffered similar hacking incidents and competitors seeking to capitalize on Lotte Card's suspension are closely watching the outcome.
According to financial sector sources on the 30th, the Financial Services Commission is scheduled to hold its regular meeting on the 31st to decide on the sanction level for the Lotte Card hacking incident. This comes nearly one year after a large-scale customer data breach was confirmed in early September last year. Previously, the Financial Supervisory Service had approved a four-and-a-half-month suspension of operations, a fine of 5 billion won, and disciplinary warnings for all senior executives before submitting the proposal to the Financial Services Commission.
The key issue is whether the four-and-a-half-month suspension can be reduced. Although the original proposal from the Financial Supervisory Service will be presented as-is at the regular meeting of the Financial Services Commission, there remains a possibility that it could be somewhat relaxed during the meeting process, such as to a three-month suspension.
A four-and-a-half-month suspension could significantly disrupt Lotte Card’s operational foundation. During the suspension period, no new members can be recruited, meaning only member attrition will occur. From January through June this year, Lotte Card's average monthly number of cancelled memberships was 77,000. A simple calculation over four-and-a-half months suggests a potential loss of 346,500 members.
After applying the four-and-a-half-month suspension, the projected number of members would be approximately 9.1 million. In contrast, if normal operations had continued during the same period, the projected membership would have been around 9.511 million. This means Lotte Card could lose about 410,000 members due to the suspension effect. During its three-month suspension in March 2014, Lotte Card saw a sharp decline of approximately 10% in individual memberships within one year.
A bigger problem lies in funding costs. Credit rating agencies are monitoring changes in Lotte Card’s membership numbers and market position following the suspension. With recent interest rate hikes increasing funding costs for card companies, a downgrade in credit rating is expected to intensify cost pressures.
Mid-to-lower tier card issuers stand to gain from this situation. Woori Card surpassed 7.0% market share in the personal credit card market for the first time in the first half of this year and is rapidly catching up to Lotte Card. The gap in personal credit card market share between the two companies was 2.93 percentage points in the first half of last year but narrowed to 1.91 percentage points this year, a reduction of more than 1.0 percentage point within a year.
A card industry executive stated, "It's like a basketball game; if you block the opponent's attack and successfully make a three-point shot, it effectively creates a five-point difference." He added, "While Lotte Card is unable to conduct business, competitors will surge ahead, causing the market share gap to shrink rapidly."
The Lotte Card case is expected to have a significant impact on the industry as it marks the first operational suspension of a financial institution due to an external hacking attack.
A recent similar case involves SGISeoul Guarantee. In July last year, SGISeoul Guarantee suffered a ransomware attack that paralyzed core operations including all types of loans, home mortgage guarantees, and HyeDaejeon installment guarantees for approximately 70 hours.
However, the key distinction in the SGISeoul Guarantee case is that it involved operational disruptions and recovery delays rather than large-scale customer data breaches, making it different from the Lotte Card incident. Additionally, as an insurance company, the applicable laws differ from those governing card companies, adding another variable.
An executive at SGISeoul Guarantee stated, "We understand that Lotte Card's case is being primarily reviewed regarding personal information leaks." He added, "The financial authorities' judgment may vary depending on the circumstances of the incident and the applicable laws."
in FINANCE
