Lotte Card, which leaked customer information on nearly 3 million customers in a hacking incident last year, appears likely to face sanctions including a business suspension and an administrative fine of about 5 billion won.

An official at the Financial Supervisory Service said in a phone call on the 9th, “We gave Lotte Card prior notice last week of a proposed sanctions plan that includes a business suspension and an administrative fine.” The level of sanctions is reported to be a 4.5-month business suspension and a 5 billion won administrative fine, and personnel sanctions are also said to be included.

It appears that the Financial Supervisory Service has prepared a severe sanctions plan within the statutory limits. Under the current Specialized Credit Finance Business Act, a business suspension for card companies can be imposed for up to six months. The Credit Information Act stipulates that an administrative fine of up to 5 billion won may be imposed for information leakage caused by hacking.

However, the sanctions plan pre-notified by the Financial Supervisory Service is not final. The Financial Supervisory Service will submit the plan to the Sanctions Review Committee on the 16th for deliberation, and the final sanctions will be confirmed only after a resolution at the Financial Services Commission’s regular meeting.

Lotte Card also received a three-month business suspension in 2014, along with KB Kookmin Card and NH Nonghyup Card, over a customer data leak. In a report the previous day, Korea Ratings said, “This time, repeated violations appear to have been reflected, resulting in a 50% increase in the suspension period,” and “If operations are suspended, restrictions on attracting new members, among other things, are likely to have a significant negative impact on performance.”

In September last year, Lotte Card leaked credit information and other data on 2.97 million people, amounting to 30% of its total customers, due to a hacking incident. Immediately after the incident, the Financial Supervisory Service conducted an intensive examination of whether Lotte Card violated the Specialized Credit Finance Business Act, the Credit Information Act, and the Electronic Financial Transactions Act.

Lotte Card was also fined 9.62 billion won last month by the Personal Information Protection Commission for violating the Personal Information Protection Act.