(2nd LD) Coupang fined record 624.7 billion won over massive data breach, unauthorized data collection

Lead

South Korea's data protection regulator has imposed a record fine of 624.7 billion won (approximately $410 million) on e-commerce giant Coupang for a massive data breach and unauthorized collection of user data, according to multiple reports from Yonhap, Al Jazeera, and the South China Morning Post. The fine is the largest ever levied by the Personal Information Protection Commission for a single data breach case.

Coverage Comparison

The fine amount was consistently reported as 624.7 billion won across sources, with dollar conversions varying slightly: Yonhap and the South China Morning Post cited $410 million, Al Jazeera reported $408 million, and one Yonhap article noted $409 million. The number of affected users also varied across reports: Al Jazeera cited 33 million, the South China Morning Post said 30 million, while multiple Yonhap articles reported 37 million users, with one specifying that 37.5 million users were affected, including 33.2 million members and 4.3 million non-members. The discrepancy may be due to differing measurement periods or inclusion criteria. Yonhap also clarified that the regulator's figure is higher than the 33.67 million accounts earlier determined by a joint private-public probe.

The basis for the fine was consistent: Coupang was penalized for failing to implement adequate safety measures, delaying reporting of the breach, and collecting online activity data of users without permission.

Key Claims

• Record fine: The Personal Information Protection Commission fined Coupang a total of 624.7 billion won, comprising 423.58 billion won for the data breach and 201.16 billion won for unauthorized collection of online user activity data, according to Yonhap. This far exceeds the previous record fine of 134.8 billion won imposed on SK Telecom in August 2025.

• Data breach scale: The breach, first reported in November 2025, exposed personal information of more than 37 million users in South Korea, including names, phone numbers, and delivery details, as reported by Yonhap. Al Jazeera reported 33 million customers affected, and the South China Morning Post cited 30 million, but Yonhap's figure is based on the regulator's final determination.

• Inadequate safeguards: The regulator concluded that the breach was not due to sophisticated hacking but to Coupang's lack of safety measures, including poor management of authentication signing keys and lax access controls, according to Al Jazeera and the South China Morning Post. The regulator also said Coupang delayed reporting the breach beyond the 72-hour legal requirement.

• Unauthorized data collection: Coupang collected records of online activities of 11.17 million users who accessed other services without their permission, including websites and applications visited, as reported by Yonhap. The regulator also fined Coupang's logistics arm, Coupang Fulfillment Services, 248 million won for privacy violations, including maintaining a list of journalists on an employment restriction list.

• Coupang's response: Coupang expressed regret over the fine and said it plans to "clarify the facts through legal procedures," according to Yonhap. The company argued that its proactive measures to prevent secondary harm and its explanations based on clear facts were not sufficiently reflected in the regulator's decision. Al Jazeera reported that Coupang signaled it would challenge the fine in court.

Perspectives

The regulator, as represented by commission chair Song Kyung-hee, emphasized the severity of Coupang's violations. "This accident occurred due to Coupang's lack of safety measures and systems, not sophisticated hacking," Song said at a briefing, as quoted by Al Jazeera. She added that Coupang's delayed notifications deprived affected individuals of the opportunity to prevent secondary harm.

Coupang, for its part, acknowledged the concern but pushed back on the regulator's conclusions. In a statement reported by Yonhap, the company said it regrets that its proactive measures and explanations were not sufficiently reflected, and it rejected claims that it failed to adequately oversee its advertising partners, saying it operates its affiliate model in compliance with laws while safeguarding customer data.

The fine has also drawn attention from US lawmakers, according to Al Jazeera, though details of their response were not specified in the reports. Coupang is incorporated in the United States, with headquarters in Seattle, and generates most of its revenue in South Korea.

The record penalty marks a significant escalation in South Korea's enforcement of privacy laws, more than tripling the previous record fine against SK Telecom. Coupang's plans to challenge the fine through legal procedures suggest the case may continue to unfold.