Coupang hit with record $410 million fine in South Korea over massive data breach

South Korea’s Personal Information Protection Commission imposed a record penalty of 625 billion won (about $410 million) on e‑commerce giant Coupang, the largest data‑breach fine in the country’s history. The regulator said the breach exposed personal information of more than 33 million customers – names, addresses, phone numbers and delivery details – and that Coupang also illegally collected online‑activity data on roughly 11 million users. The fine was split into 423.58 billion won for the data breach, 201.16 billion won for unauthorized data collection, and additional smaller penalties for violations by its logistics arm.

The commission cited a lack of safety measures, delayed breach notification beyond the mandated 72‑hour window, and failure to detect abnormal traffic. A former employee of Chinese nationality allegedly stole a security key that enabled unauthorized access. Coupang apologized, said it would contest the decision, and noted that the fine represents about 1.4 % of its projected 2025 revenue. The penalty far exceeds the previous record of an $88 million fine levied on SK Telecom.

Chairperson Song Kyung‑hee remarked, “This accident occurred due to Coupang’s lack of safety measures and systems, not sophisticated hacking,” emphasizing the regulator’s view that internal control failures caused the leak.