South Korea fines Coupang $526.5 million in country’s largest data breach penalty
South Korea has imposed a record fine of 625 billion won (S$526.5 million) on e-commerce company Coupang over a massive data breach involving customer information and illegal collection of personal data.
The penalty was issued by the Personal Information Protection Commission after the company was found to have exposed personal information belonging to more than 33 million customers and failed to detect the breach within the legally required 72-hour period, News.Az reports, citing Asia One.
Regulator described the incident as the result of internal failures rather than sophisticated external hacking. Commission chairperson Song Kyung-hee said the breach occurred due to a lack of adequate safety measures and systems within Coupang.
According to the findings of a government-led investigation, a former employee allegedly stole a security key and gained unauthorised access to customer accounts, exposing weaknesses in the company’s internal security systems.
The regulator also said Coupang’s marketing programme had illegally collected online activity data from around 11 million customers without consent. Officials added that the company failed to detect unusual traffic linked to the breach until it was alerted by a customer inquiry.
Coupang, which is listed in New York but generates most of its revenue in South Korea, issued an apology following the decision, while also expressing disagreement with aspects of the regulator’s findings. The company said its preventive measures and explanations had not been fully reflected in the ruling.
The fine is equivalent to around 1.4 per cent of Coupang’s 2025 revenue, estimated at 45 trillion won, and follows broader scrutiny of the company’s handling of personal data amid its dominant position in South Korea’s e-commerce and logistics sector.
By Leyla Şirinova
Similar news
