South Korea Fines Coupang $409 Million for Data Breach

Key Takeaways

• Coupang faces a $409 million fine, the largest data protection penalty in South Korean history
• A former employee stole a security key and accessed 33 million customer accounts after leaving the company
• The company also illegally collected browsing data from 11 million customers without consent

What Happened

South Korea's Personal Information Protection Commission fined Coupang 625 billion won ($409 million) on Thursday for leaking personal data from more than 33 million customer accounts. The penalty is the largest data breach fine ever imposed in South Korea.

The fine amounts to 1.4% of Coupang's 2025 revenue of 45 trillion won. The New York-listed company generates most of its revenue in South Korea, where it dominates the e-commerce market with fast delivery of groceries, food, and other goods.

A Former Employee, Not a Sophisticated Attack

The breach traced back to a former employee, a Chinese national, who stole a security key and used it to access customer accounts after leaving the company. South Korea's science ministry found the root cause was management failure, not advanced hacking techniques.

“This accident occurred due to Coupang's lack of safety measures and systems, not sophisticated hacking.”

— Song Kyung-hee, Chairperson, Personal Information Protection Commission

Song said Coupang's security system allowed the hacker to access personal information for all customers with a single compromised key. The company did not revoke the employee's access credentials after they left. Coupang also failed to notice an unusual spike in traffic to its customer database until a customer reported suspicious activity.

The company missed the 72-hour window required by law to detect and report the breach.

Illegal Data Collection Adds to the Fine

The regulator found a second violation. Coupang's marketing program tracked online activity from around 11 million customers without their consent. This illegal collection was separate from the data leak but contributed to the record penalty.

Coupang's Response

Coupang apologized for causing concern to customers and the public after the fine was announced. But the company pushed back on the regulator's decision.

"We regret that our proactive measures to prevent secondary harm from last year's data leak incident, as well as our explanations based on clear facts, were not sufficiently reflected" in the decision, the company said.

The company's compensation plan has drawn criticism. Reports indicate Coupang offered affected customers shopping vouchers rather than direct financial payments. Online communities described this as a marketing tactic that forces victims to spend more money with the company that failed to protect them.

Trade Tensions in the Background

The investigation added friction to U.S.-South Korea trade relations. Some in Washington raised concerns that Korean authorities had gone too far in their treatment of the U.S.-listed company while the two countries negotiated trade deal details.

South Korea rejected the framing. Officials said the Coupang probe was neither a trade nor security issue and should be handled separately from ongoing talks with Washington.

Market Position at Stake

Coupang controls about 40% of South Korea's logistics services, the largest market share among competitors, according to Seoul-based IM Securities. The fine represents a significant cost but not an existential threat given the company's scale.

The penalty signals that South Korean regulators will impose serious consequences for data protection failures. Companies operating in the market should expect enforcement to match the severity of the breach.

Frequently Asked Questions

Why was Coupang fined $409 million?

South Korea's privacy regulator found Coupang leaked personal data from 33 million customers after a former employee stole a security key. The company also illegally collected browsing data from 11 million users without consent.

How did the Coupang data breach happen?

A former employee, a Chinese national, stole a cryptographic security key before leaving the company. Coupang never revoked the key, allowing the ex-employee to access all customer accounts remotely.

Is this the largest data breach fine in South Korea?

Yes. The 625 billion won ($409 million) penalty is the largest data protection fine ever imposed on a company in South Korea.

What customer data was leaked in the Coupang breach?

The breach exposed personal information from more than 33 million customer accounts. The exact types of data exposed have not been fully disclosed, but the breach affected roughly two-thirds of South Korea's population.

How did Coupang respond to the fine?

Coupang apologized but said its explanations and preventive measures were not adequately considered by the regulator. The company offered shopping vouchers as compensation, which drew criticism from affected customers.

Source: Tech-Economic Times / ET