Exclusive: Lotte Card Cuts Information Protection Budget 15.2% Despite MBK's Security Claims

Regarding the Lotte Card hacking incident that leaked the personal information of 2.97 million members, MBK Partners, the major shareholder,...

Regarding the Lotte Card hacking incident that leaked the personal information of 2.97 million members, MBK Partners, the major shareholder, explained that it had increased security investments. However, it was confirmed that Lotte Card’s information protection budget for this year decreased compared to last year.

According to the ‘Status of Total Budget and Information Protection Budget for Dedicated Credit Card Companies (Based on Annual Allocation)’ received by the office of Rep. Kim Sang-hoon of the People Power Party in the National Assembly’s Political Affairs Committee through the Financial Supervisory Service on the 22nd, Lotte Card’s information protection budget allocation for this year was 12.8 billion Korean won, a 15.2% decrease from last year’s 15.1 billion Korean won.

Among the eight dedicated credit card companies (Samsung, Shinhan, Hyundai, KB Kookmin, Woori, Hana, Lotte, and BC Card), only Lotte Card, Hana Card (-11.8%), and Hyundai Card (-10.5%) saw reductions in their information protection budgets. In contrast, KB Kookmin Card increased its information protection budget to 33 billion Korean won this year, a 61.8% increase from last year’s 20.4 billion Korean won. Samsung Card (26.4%), Woori Card (11.5%), and Shinhan Card (10.4%) also increased their budgets.

MBK explained that it had not only increased the budget but also expanded its internal information protection workforce. However, when considering only the ratio of information protection personnel, it actually decreased. In 2020, Lotte Card’s total IT workforce was 74, with 20 information protection personnel, accounting for 27%. As of June this year, the total IT workforce at Lotte Card was 226, with only 35 information protection personnel, accounting for 15%. Lotte Card’s IT executives also numbered only three, accounting for 7% of the total 45 executives, ranking among the lowest among the eight dedicated credit card companies.

Despite MBK’s active explanations, management loopholes at the card company, which requires high-level security capabilities, have been exposed, making it difficult to avoid responsibility. Notably, Lotte Card’s information protection investment ratio also decreased in line with MBK’s first attempt to sell the company. According to Lotte Card’s Sustainability Management Report, the ratio of information protection investment relative to the IT budget decreased from 12% in 2021 to 10% in 2022 and further to 8% in 2023.

MBK acquired Lotte Card in May 2019, attempted its first sale in 2022, and has been trying to sell it even at a reduced price this year. This aligns with the inflection point when the information protection investment ratio began to decline. As responsibility issues emerged, Kim Byung-joo, MBK’s chairman, was selected as a witness for the hearing on large-scale hacking incidents at telecommunications and financial companies held by the National Assembly’s Science, ICT, Broadcasting, and Communications Committee on the 24th.

Financial authorities have also warned of the highest level of sanctions regarding this incident. With severe disciplinary actions, including the suspension of Lotte Card’s business, expected, both MBK and Lotte Card’s management are unlikely to avoid responsibility. The credit card industry has pointed out that private equity funds may tend to reduce costs such as security investments to maximize short-term profits.