Pull to refresh
Logo
Daily Brief
Following Why Sign Up
South Korea fines Coupang record sum over data breach

South Korea fines Coupang record sum over data breach

Rule Changes

A former engineer's retained signing key exposed data on most of the country, and the privacy regulator answered with the largest fine in its history.

June 11th, 2026: Record $409 million fine imposed

Overview

Updated Jun 12

South Korea's privacy regulator fined Coupang 624.7 billion won, roughly $409 million, for a breach that exposed data on 37.5 million accounts, more than 70% of the country's population. The penalty is the largest in Korea's privacy enforcement history. It landed below analyst projections of up to 1 trillion won, and Coupang shares jumped 14% on June 11, their best single-day gain since November 2022.

The regulator blamed weak security rather than sophisticated hacking: a former engineer kept a signing key after leaving, forged login tokens, and accessed customer systems undetected for months. Coupang is challenging the fine in the Seoul Administrative Court, though Korean law does not stay payment during an appeal. A separate 248 million won fine also hit Coupang's logistics arm for blacklisting police press corps journalists and submitting workers' health records to courts without consent.

Why it matters

If you shopped on Korea's biggest online store, your name, address, phone, and order history were likely exposed, and the company that held them is contesting the bill.

Questions about this story

Free account needed to ask — your question is kept and asked for you right after sign-up. Answers are public.

No questions yet — be the first to ask.

Key Indicators

$409M
Total fine
Largest data-privacy penalty in South Korean history.
37.5M
Accounts exposed
More than 70% of South Korea's population.
11.17M
Users tracked without consent
Online activity collected across third-party sites and apps.
~7 months
Undetected access
Intruder had access from mid-April to early November 2025.
$1.2B
Compensation pledged
Coupang's 1.7 trillion won plan to restore customer trust.

Voices

Curated perspectives — historical figures and your fellow readers.

Ever wondered what historical figures would say about today's headlines?

Sign up to generate historical perspectives on this story.

Log in Sign Up

People Involved

Song Kyung-hee
Song Kyung-hee
Chairwoman, Personal Information Protection Commission
Led the enforcement action and public findings
 Bom Kim
Bom Kim
Founder and Chief Executive, Coupang
Apologized publicly; company is contesting related rulings
 Harold Rogers
Harold Rogers
Interim Chief Executive, Coupang
Represented Coupang before US lawmakers

Organizations Involved

Coupang
Coupang
E-commerce Company
Fined; challenging ruling in Seoul Administrative Court while paying fine during appeal

South Korea's largest online retailer, listed on the New York Stock Exchange and headquartered in part in Seattle.
Personal Information Protection Commission
Personal Information Protection Commission
Federal Privacy Regulator
Issued the fine

South Korea's data-privacy regulator, with power to investigate breaches and levy penalties.

Timeline

November 2024 June 2026

13 events Latest: June 11th, 2026 · 3 months ago Showing 8 of 13
Tap a bar to jump to that date

  1. Record $409 million fine imposed

    Latest Legal

    The PIPC fines Coupang 624.7 billion won, splitting it between the leak and unauthorized tracking of 11.17 million users. Coupang vows to appeal.

  2. Coupang shares jump 14% as fine lands below worst-case

    Market

    CPNG closed up 14%, its best single day since November 2022, after the 624.7 billion won fine came in well below the roughly 1 trillion won ceiling analysts had feared. Morgan Stanley maintained its Overweight rating at a $28 price target, saying the penalty was in line with its $400 million estimate and removed a major overhang on the stock.

  3. Coupang files 8-K; fine to hit Q2 operating results

    Regulatory

    Coupang disclosed the fines in an 8-K filing with the US Securities and Exchange Commission. The roughly $410 million charge will be recorded in Q2 2026 operating expenses and is not deductible for income tax. The company noted it had not yet received PIPC's formal written decision and confirmed it will pursue judicial relief in the Seoul Administrative Court.

  4. Logistics unit fined separately for journalist blacklist

    Legal

    The PIPC imposed a separate 248 million won fine on Coupang Fulfillment Services for collecting personal data on 71 police press corps journalists without authorization and registering them on an internal employment restriction list. The subsidiary was also cited for submitting workers' weight and health records, gathered for employee wellness purposes, to courts without consent during industrial accident litigation.

  5. US investors withdraw Section 301 petition

    Trade

    Greenoaks Capital Partners and Altimeter Capital withdrew their January 2026 petition asking the US Trade Representative to investigate South Korea's treatment of Coupang. The firms said broader US trade probes already under way would address the same concerns more effectively. A separate investor-state dispute settlement claim under the US-Korea Free Trade Agreement remains pending.

  6. Korean ministry calls it a management failure

    Investigation

    The Ministry of Science and ICT concludes the breach stemmed from poor management, not a sophisticated cyberattack.

  7. US investors file trade petition

    Trade

    Two US investment firms file a Section 301 petition with the US Trade Representative, alleging discrimination against American companies.

  8. Coupang pledges $1.2 billion compensation

    Response

    The company announces a 1.7 trillion won plan to compensate affected customers and rebuild trust.

  9. Scale revealed: 33.7 million accounts

    Disclosure

    Coupang publicly discloses that roughly 33.7 million user accounts were compromised in the breach.

  10. Breach reported late to authorities

    Regulatory

    Coupang notifies regulators more than 53 hours after discovery, past the required reporting window.

  11. Coupang discovers the intrusion

    Detection

    The company finds the unauthorized access after the former employee sends threatening anonymous emails. Initial estimate: about 4,500 accounts.

  12. Unauthorized access begins

    Breach

    The former engineer allegedly forges authentication tokens and starts accessing customer systems, continuing into November.

  13. Engineer leaves with access to signing key

    Origin

    A Coupang engineer who helped build a backup authentication system departs the company, retaining an internal signing key.

Scenarios

1

Court trims or overturns the fine

Possible Resolves by End of 2027

Discussed by: Korea Times, Korea Herald (reporting Coupang's stated legal plans)

Coupang files suit and a Korean court reduces or cancels the penalty, agreeing that the company's own response and disputed loss figures were undervalued by regulators. Coupang has already shown it will litigate, having separately challenged the Fair Trade Commission over Bom Kim's status. A win here would weaken the regulator's new benchmark before it sets in.

2

Fine stands as the new enforcement benchmark

Possible Resolves by Q2 2028

Discussed by: TechCrunch, Nikkei Asia, SCMP

Courts uphold the penalty, or Coupang pays without a successful challenge, cementing 624.7 billion won as the reference point for Korean privacy enforcement. The PIPC has framed the case as a deliberate signal to large data holders. If it holds, future breaches involving tens of millions of records face penalties scaled to this case rather than the older SK Telecom mark.

3

Breach becomes a formal US-Korea trade dispute

Uncertain Resolves by Q2 2027

Discussed by: Korea Economic Institute of America, US House committees

The case escalates from petitions into binding trade machinery. US investors have filed investor-state dispute settlement notices under the US-Korea Free Trade Agreement, and a Section 301 review is pending. If the USTR opens a formal action or an arbitration tribunal is convened over Coupang's treatment, the breach stops being a privacy matter and becomes a state-to-state fight.

Historical Context

3 moments from history that rhyme with this story — and how they unfolded.

September 2017

Equifax data breach (2017)

Attackers exploited an unpatched flaw at credit bureau Equifax and exposed sensitive data on about 147 million Americans. The cause was a known vulnerability left unfixed, not a novel hack.

Then

Equifax's CEO resigned and the company faced a wave of investigations and lawsuits.

Now

A 2019 settlement reached up to $700 million, becoming a reference point for breach penalties tied to basic security lapses.

Why this matters now

Like Coupang, Equifax was punished for preventable failures rather than sophisticated attacks, and both fines turned on negligence.

May 2023

Meta GDPR fine over data transfers (2023)

Ireland's privacy regulator fined Meta 1.2 billion euros over transfers of European user data to the US, the largest penalty under the EU's data-protection law at the time.

Then

Meta was ordered to suspend the transfers and given a deadline to comply.

Now

The case showed regulators willing to impose record fines on global tech firms and to treat data handling as a sovereignty issue.

Why this matters now

Both cases show national regulators using record fines against large platforms, and both raised cross-border friction over data.

2025

SK Telecom data breach fine (2025)

South Korea's largest mobile carrier suffered a breach and drew an $88 million penalty, then the biggest privacy fine in the country. Regulators cited weak safeguards over subscriber data.

Then

The fine set the prior national ceiling for privacy penalties and pushed carriers to harden systems.

Now

It established that Korean regulators would scale fines to the size of the data holder, setting up an even larger Coupang penalty.

Why this matters now

Coupang's fine is more than four times the SK Telecom mark, showing how fast Korea's privacy penalties are climbing.

Sources

(18)
+12
TechCrunch Nikkei Asia South China Morning Post The Korea Herald The Korea Times Korea Economic Institute of America GuruFocus StockTwits The Motley Fool SEC EDGAR StockTitan PYMNTS BizzBuzz News UPI Seoul Economic Daily TechCrunch The Korea Herald The Korea Herald