South Korea Fines Coupang Over Massive Customer Data Breach

South Korea’s Personal Information Protection Commission imposed a record 624.6 billion won fine on Coupang, plus 248 million won on subsidiary Coupang Fulfillment Service, after a breach exposed personal data tied to roughly 34 million to 37.55 million people. Regulators said the incident stemmed from weak security controls, including poor authentication key management and inadequate access restrictions, and that exposed data included names, email addresses, shipping addresses, phone numbers, and order histories. Authorities said the breach began in 2025 and persisted for months before discovery, making it one of the country’s largest retail-sector privacy incidents.

The commission also cited Coupang for failures involving data destruction, breach notification, interference with the independence of its data protection officer, and obstruction of the investigation. Investigators identified the main suspect as a former Coupang IT employee, described in one report as a 43-year-old Chinese national, who allegedly retained sensitive data on multiple hard drives and tried to destroy evidence by discarding a laptop in a river. Coupang said it plans to challenge the penalty, disputed aspects of the exposure, and maintained the stolen data was limited, deleted from recovered devices, and not shared onward.