South Korea fines Coupang record $409M over data breach

South Korea's Personal Information Protection Commission has levied its largest penalty to date against e-commerce leader Coupang, imposing 624.6 billion won, or roughly $409 million, after a breach compromised personal details of more than 37 million customers.

PIPC cites multiple violations in security practices. Investigators determined that the personal information of approximately 37.55 million individuals was exposed because of weak safeguards. These included lapses in authentication signature key oversight and access restrictions. The probe also uncovered failures to properly destroy records, delayed breach notifications, meddling with the data protection officer's autonomy, and efforts to hinder the official review.

Coupang Fulfillment Service faces a separate 248 million won sanction for gathering, processing, and managing customer personal and sensitive information without proper authorization. According to the PIPC, the sanctions encompass "a fine of 624.681 billion won and a fine of 16.8 million won" plus corrective measures, public notices, and disclosure requirements.

Breach timeline and suspect identified. The incident took place in late June yet went undetected until mid-November, at which point the retailer notified users that 33.7 million accounts had been affected. Officials named a 43-year-old Chinese national formerly employed in Coupang's IT unit from 2022 through 2024 as the main suspect.

The company reported that the ex-worker surrendered several hard drives holding sensitive material. He had thrown a MacBook Air into a river to eliminate proof, though authorities retrieved the machine. Coupang further stated the individual kept information tied to roughly 3,000 accounts despite viewing millions, but later erased it from every device without sharing it externally.

Company response includes compensation plan. In late December the firm disclosed intentions to disburse 1.685 trillion won, or about $1.17 billion, while issuing single-use purchase vouchers worth 50,000 won, or roughly $34, to each customer beginning in January 2026. The move aims to address harm to more than 33 million people. Coupang, an American online retailer active in South Korea, maintains a workforce of 95,000 and generates annual revenue above $30 billion.

Context of similar large-scale incidents in Korea. SK Telecom, the nation's biggest mobile carrier, alerted subscribers in April that USIM information had been compromised after malware infiltrated its infrastructure. The operator subsequently disclosed that the malicious code first appeared in June 2022 and ultimately touched 27 million users, nearly its full subscriber list.

Coupang's former employee worked in its IT department until 2024.