Coupang hit with record W624.7b privacy fine
Coupang hit with record W624.7b privacy fine
https://www.koreaherald.com/article/10769731
Publish Date: 2026-06-11 01:02:00
Source Domain: www.koreaherald.com
Penalty imposed for data breach affecting 37.5 million people and unauthorized tracking of 11.2 million
A red light is illuminated at a crosswalk near Coupang’s Korean headquarters in Seoul. (Im Se-jun/The Korea Herald)
South Korea’s privacy watchdog has imposed a record 624.68 billion won ($409 million) fine on Coupang over a massive data breach and unauthorized tracking of users’ online activity.
The Personal Information Protection Commission said Thursday the penalty was approved at a plenary meeting the previous day after it found that the e-commerce giant had failed to maintain basic safeguards for customer data, citing poor management of authentication signing keys and weak access controls.
The penalty is the largest ever imposed by a Korean government agency on a company over a data breach, surpassing the previous record set in August last year when SK Telecom was fined 134.79 billion won and ordered to pay 9.6 million won in administrative penalties over a hacking incident.
For comparison, Ireland’s Data Protection Commission fined Meta 265 million euros ($306 million) in 2021 after the personal data of 533 million users was exposed.
The fine on Coupang is roughly equal to the $473 million in operating profit that the company recorded last year.
The regulator said Coupang’s security lapses led to the leak of personal information belonging to some 37.5 million people, raising the scale from an earlier government-led probe in February that found 33.67 million compromised records, including names and email addresses. Of the total penalty, 423.58 billion won was imposed over the breach, along with 16.8 million won in administrative fines.
The PIPC also found that Coupang failed to notify affected individuals, neglected its obligation to delete personal data, failed to ensure the independence of its chief privacy officer and interfered with the regulator’s inquiry. It ordered the company to strengthen data security controls, notify affected…
