South Korea slaps record $409 million fine on Coupang over data breach

MUMBAI: When the watchdog came knocking, the bill was anything but a discount. South Korea has handed e-commerce giant Coupang a record-breaking penalty after a data breach exposed the personal information of millions of users and uncovered wider privacy compliance failures. South Korea has imposed a record 625 billion won ($409 million or roughly Rs 3,400 crore) fine on e-commerce heavyweight Coupang following a sweeping investigation into a data breach that exposed the personal information of more than 33 million users.

The penalty, levied by the country’s Personal Information Protection Commission (PIPC), is the largest data protection fine ever imposed in South Korea and underscores growing regulatory intolerance towards weak corporate data governance.

Far from being the result of a sophisticated cyberattack, regulators said the incident stemmed from internal failings.

“This accident occurred due to Coupang’s lack of safety measures and systems,” PIPC chair Song Kyung-hee said, pointing to inadequate safeguards, weak oversight and shortcomings in the company’s security framework.

According to investigators, the breach was linked to a former employee who allegedly used internal credentials to gain unauthorised access to company systems over an extended period. Authorities said personal information, including customer names, phone numbers and delivery details, was exposed.

The findings also revealed that Coupang failed to identify and report the breach within South Korea’s mandatory 72-hour disclosure window. Regulators further criticised delays in notifying affected users, arguing that the lag reduced their ability to take preventive measures against potential misuse of their information.

The data leak was only part of the problem.

The PIPC also found that Coupang had unlawfully collected online activity data from around 11 million users without obtaining proper consent, adding another layer to the company’s privacy troubles and significantly increasing the overall penalty.

The 625 billion won sanction represents roughly 1.4 per cent of Coupang’s annual revenue, making it one of the most severe financial penalties imposed on a technology platform in the country. The fine comfortably surpasses the previous record-holder, a penalty of around 134.8 billion won imposed on SK Telecom last year.

Coupang has apologised for the incident and acknowledged customer concerns. However, the company has also signalled that it may challenge aspects of the regulator’s conclusions, arguing that some of its response efforts were not adequately reflected in the final ruling.

The case arrives at a time when governments worldwide are tightening scrutiny of how digital platforms collect, store and protect user information. For South Korea, the record fine sends a clear message: in an economy powered by data, weak privacy safeguards can prove far more expensive than investing in stronger ones.