Coupang hit with record 6.2‑trillion‑won fine over massive data breach

South Korea’s Personal Information Protection Commission imposed a record penalty of 6,246.81 billion won (about $4.6 billion) on e‑commerce giant Coupang after finding the firm responsible for a large‑scale personal data breach affecting roughly 37.5 million users and for unlawfully collecting online activity logs of non‑members. The commission also fined its logistics subsidiary, Coupang Fulfillment Service, for maintaining a blacklist of 71 journalists.

The regulator cited serious shortcomings in authentication‑key management, inadequate safety‑measure controls, unauthorized gathering of browsing data, and violations of privacy‑officer independence and data‑deletion obligations. It ordered Coupang to strengthen security, improve transparency and notify affected persons.

Coupang issued a statement expressing regret over the commission’s decision, pledged to protect customer information, and announced it will contest the ruling through legal channels. The fine surpasses the previous Korean record of 1.348 trillion won imposed on SK Telecom, making it the largest penalty for a data‑privacy breach in the country.

U.S. officials have raised the issue in trade discussions, suggesting the case could be perceived as discriminatory against an American‑listed company and warning of possible trade‑friction implications, while Korean authorities stress the enforcement is based on domestic law.