South Korean authorities levied Wednesday (June 10) a historic 624.7 billion won (about $412 million) fine against the eCommerce giant Coupang following a massive data breach that affected approximately two-thirds of the nation’s population.
This penalty, handed down by the Personal Information Protection Commission (PIPC), represents the largest ever imposed for a privacy violation in South Korea, Bloomberg reported on Wednesday (June 10).
The PIPC’s investigation uncovered that a former employee maintained unauthorized access to personal information from nearly 34 million accounts over several months without being detected. PIPC
According to the report, PIPC Chairperson Kyung Hee Song said the breach was not the result of advanced hacking techniques but rather “negligent management” and an “inadequate basic safety management system” that failed to keep pace with Coupang’s aggressive expansion and reliance on large-scale customer data to provide innovative services.
The financial penalty is divided into two main parts: 423.6 billion won for the actual data leak and 201.1 billion won for the non-consensual collection of data. In addition, Coupang Fulfillment Services, the company’s logistics subsidiary, received a separate fine for the unlawful use of personal information to create an employment restriction list.
The incident has also evolved into a diplomatic point of contention between South Korea and the United States. While Coupang operates primarily in South Korea, it is incorporated in the U.S. and listed on the American stock market. This unique position led major investor Greenoaks Capital Partners to allege “discriminatory treatment” of the company and request a U.S. government investigation, Bloomberg reported. In response, South Korean lawmakers have pushed back against what they describe as U.S. political interference.
Beyond the administrative penalties in South Korea, Coupang is currently facing an investor class action lawsuit filed in California for alleged violations of U.S. securities laws. The complaint asserted that the retailer misled investors by understating its susceptibility to cyberattacks and overstating the strength of its data safeguards in official filings. Furthermore, the lawsuit alleged that the company failed to provide a timely disclosure of the breach.
