South Korea fines Coupang record 624.7 billion won for data leak

South Korea’s Personal Information Protection Commission imposed a record 624.7 billion won ($527 million) fine on Coupang’s South Korean entity for a data breach affecting nearly 34 million accounts, or about two-thirds of the country’s population. The breach occurred due to a former employee improperly accessing personal data, which went undetected for months, according to the regulator. Kyung Hee Song, chairperson of the commission, stated the incident resulted from Coupang’s inadequate safety management and negligent oversight, despite its rapid growth fueled by large-scale customer data. The fine is the largest ever levied in South Korea for a personal data breach, surpassing the 134.8 billion won penalty imposed on SK Telecom last year. Under South Korean law, fines can reach up to 3% of annual sales. The regulator’s decision has intensified domestic criticism of Coupang and created diplomatic friction with the US, as South Korean lawmakers accused Washington of exerting political pressure over the treatment of Coupang’s executives. Coupang responded by stating it regretted the decision, arguing it did not fully reflect the company’s efforts to prevent further harm after last year’s data leak. The company also noted it could challenge the ruling in court. Additionally, Coupang Fulfillment Services, the company’s logistics subsidiary, received a separate 248 million won fine for unlawfully collecting personal information and misusing it to place individuals on an employment restriction list. The breach has had financial repercussions for Coupang, which warned of slower revenue growth this year after issuing vouchers to affected customers. The company’s shares have dropped approximately 35% since the start of the year. The incident underscores growing concerns over data security in South Korea’s tech sector and the regulatory scrutiny facing major digital platforms.