South Korea will fine Coupang 409.30 million won over a major data breach and illegal data collection, the country’s largest penalty on a company. The Personal Information Protection Commission said Coupang leaked data of over 33 million customers and didn’t detect the breach within 72 hours as the law requires.
The fine is 1.4% of Coupang’s 2025 revenue of 45 trillion won, according to Reuters. Chairperson Song Kyung-hee blamed the breach on Coupang’s lack of safety measures, not hacking, and said the company’s security system allowed easy access even after the suspect left.
Coupang admitted to causing concern and regretted the regulator’s decision, saying their efforts weren’t fully reflected. The company generates most revenue in South Korea, offering fast delivery of groceries and goods.
An investigation earlier this year blamed management failure and a former employee, a Chinese national, for stealing a security key. Coupang’s system failed to detect unusual data traffic until a customer’s inquiry.
The regulator also found the company had illegally collected data from 11 million customers without consent. The probe increased trade tensions with Washington, but South Korea stated the investigation was separate from trade talks. Coupang controls about 40% of South Korea’s logistics market, but lacks proper data protection systems, according to Song.
