South Korea Slaps Record $408 Million Fine on Coupang Over Massive Data Breach

Record-Breaking Penalty Imposed on E-Commerce Giant

South Korea’s Personal Information Protection Commission (PIPC) delivered a historic blow to e-commerce giant Coupang on Thursday, imposing a $408 million fine following a massive data breach that compromised more than 30 million customer accounts. The penalty represents the largest fine ever issued by South Korean regulators for a data privacy violation, dwarfing the previous record of $88 million levied against mobile carrier SK Telecom last year. The staggering total combines 423.6 billion won for the personal data breach itself and an additional 201 billion won for the non-consensual collection of user information.

The breach, which first surfaced in November, affected approximately 37.5 million users according to commission findings-a figure representing more than half of South Korea’s population of around 50 million people. Investigators discovered that inadequate basic safeguards, including poor management of authentication signing keys and lax access controls, directly caused the exposure of sensitive customer information. The breach compromised names, contact details, delivery addresses, and order histories of users on Coupang, the country’s largest online retail platform often compared to Amazon.

Regulatory Failures and Delayed Notifications

Commission chairperson Song Kyung-hee delivered sharp criticism during Thursday’s briefing, emphasizing that management failure-not sophisticated hacking-created the vulnerability. The company’s inadequate safety measures and systems allowed the breach to occur and persist, investigators determined. Regulators also found that Coupang failed to report the breach within the 72-hour window required by South Korean law, a violation that left customers exposed to potential secondary harm without their knowledge.

“As a result, those individuals were unaware of the breach and deprived of the opportunity to take steps to prevent secondary harm,” Song told reporters at the briefing.

The investigation revealed that Coupang initially reported only 4,500 customer accounts affected when it first notified authorities in November. Later internal checks, however, uncovered that nearly 34 million customer accounts-all located in South Korea-likely suffered exposure. The company believes the breach began as early as June through a server based abroad, though the company has maintained in some statements that only 3,000 customer records were involved.

Company Response and Legal Challenge Ahead

Coupang, which operates from Seattle, Washington, but generates the majority of its revenue in South Korea, issued a statement expressing deep regret for the concern caused to customers and the public. The New York-listed company acknowledged the incident while simultaneously signaling its intention to challenge the commission’s decision in court. Company representatives expressed disappointment that their proactive measures to prevent secondary damage and explanations based on what they characterized as clear facts were not adequately considered during the regulatory process.

“Upon receiving the official resolution from the PIPC, we expect that the facts will be clearly established through legal procedures,” Coupang stated.

The company committed to strengthening its security measures moving forward, though it argued that its explanations and preventive actions following the data breach discovery did not receive sufficient reflection in the commission’s final determination. The legal challenge ahead will likely focus on disputed facts regarding the scope of the breach, the timeline of notifications, and the adequacy of Coupang’s response measures.

Additional Privacy Violations Uncovered

Beyond the primary data breach, regulators uncovered another serious violation that contributed to the record fine. The commission determined that Coupang unlawfully collected online activity records from users browsing third-party websites and applications. The company stored these records in a database in a state that allowed individual identification, violating privacy protections. This unauthorized data collection across external platforms represented a separate and distinct breach of South Korean data protection laws, adding significantly to the total penalty amount.

The finding demonstrates the breadth of the regulatory investigation, which extended beyond the initial breach to examine Coupang’s broader data collection and storage practices. Authorities scrutinized how the company tracked user behavior across the internet ecosystem, raising concerns about the extent of surveillance and data aggregation occurring without explicit user consent.

International Tensions and Political Pressure

The Coupang investigation unexpectedly became a source of diplomatic friction between Seoul and Washington. In April, South Korean lawmakers sent a joint letter expressing concerns over what they characterized as “undue pressure” from US politicians regarding the investigation into the American-incorporated e-commerce platform. The allegations of foreign political interference added a geopolitical dimension to what began as a domestic consumer protection matter.

The investigation also revealed that a former employee, identified as a Chinese national, allegedly stole a security key and gained unauthorized access to customer accounts according to findings by South Korea’s Ministry of Science and ICT. This international element further complicated the probe, adding concerns about cross-border security threats and insider risks to the list of systemic failures identified by investigators.

Broader Context of Cybersecurity Challenges

The Coupang penalty arrives amid a wave of high-profile cybersecurity incidents affecting major South Korean corporations despite the country’s reputation for maintaining tight data privacy standards. The nation has positioned itself as a leader in digital infrastructure and technology adoption, making these breaches particularly concerning for regulators and consumers alike. The record fine sends a clear signal that authorities intend to enforce stringent compliance standards regardless of a company’s size, market position, or international connections.

South Korean regulators’ willingness to impose such a substantial penalty on a company incorporated in the United States demonstrates the commission’s commitment to protecting domestic consumers. The dramatic escalation from the previous $88 million record fine to the current $408 million penalty reflects both the severity of the Coupang breach and the intensifying regulatory environment for data protection. Companies operating in South Korea now face unmistakable evidence that inadequate cybersecurity measures carry severe financial consequences that can reach hundreds of millions of dollars.