South Korea's Personal Information Protection Commission (PIPC) announced on May 2 a record $408 million (536 billion won) fine against Coupang, the New York-listed e-commerce company, for the largest personal data breach in the nation's history.
According to the PIPC, the incident exposed the personal information of more than 33 million customers. Coupang is accused of failing to implement necessary security measures and of not reporting the breach within the legally required 72-hour window.
PIPC Chairperson Song Kyung-hee stated at a press conference: "This incident occurred due to a lack of safety measures and systems by Coupang, not from sophisticated hacking." She stressed that Coupang "delayed notification of the breach," leaving affected individuals unaware of the incident and missing the opportunity to take steps to prevent secondary damage.
Following the announcement of the fine, Coupang apologized for causing public and customer concern. However, the company expressed: "We regret that our proactive measures to prevent secondary damage from last year's data leak, as well as our explanations based on clear facts, were not fully reflected in the regulator's decision."
Coupang, headquartered in Seattle but generating most of its revenue from South Korea, indicated it would appeal the fine in court.
The penalty dwarfs the previous record of $88 million levied against SK Telecom last year. It follows a government-led investigation earlier this year that blamed the breach on management failures.
South Korea's Ministry of Science and ICT previously said a former Chinese employee stole security keys and illegally accessed customer accounts.
The investigation into the data leak has fueled trade tensions with Washington, amid concerns that South Korean authorities have overreached in their treatment of a U.S.-listed company. In April, nearly 100 South Korean lawmakers sent a joint letter expressing concern about "excessive pressure" from U.S. politicians related to the probe, after U.S. Republican lawmakers accused the investigation of being "discriminatory regulatory action" against American businesses.
According to Seoul-based IM Securities, Coupang controls about 40% of South Korea's logistics services market, holding the largest share among competitors. Chairperson Song Kyung-hee remarked: "Coupang has grown its e-commerce business significantly based on a huge amount of customer data. But the company had no system to protect and manage customer information despite its large business scale."
