 |
Photo courtesy of Yonhap News |
[Alpha Biz= Kim Jisun] South Korea’s data protection authority is set to decide on sanctions against Coupang following a massive personal data breach affecting more than 33 million users.
The Personal Information Protection Commission announced it will review the case on June 10, approximately seven months after the incident occurred in November last year.
A joint public-private investigation confirmed that approximately 33.67 million records—including names, email addresses, and physical addresses—were exposed through a vulnerability in Coupang’s “My Information” page. The company has identified a former employee of Chinese nationality as the alleged perpetrator.
Under South Korea’s Personal Information Protection Act, companies responsible for serious data breaches can face fines of up to 3% of annual revenue. Based on Coupang’s 2025 revenue of 45.5 trillion won, the maximum penalty could reach approximately 1.36 trillion won.
However, the final fine will depend on factors such as the scale of the breach, the sensitivity of the exposed data, and the company’s response measures.
Coupang has argued that no secondary damage occurred and that the leaked data did not include highly sensitive information such as financial details. Investigators also noted that there was no confirmed evidence of external data transfers or misuse.
Additionally, the company detected the breach within about five months—significantly faster than comparable cases involving SK Telecom and Duo, where detection periods were much longer.
Nevertheless, authorities are expected to scrutinize Coupang’s internal security controls, particularly regarding access management for former employees.
The case comes amid a global trend of stricter enforcement on data protection violations. In one of the largest precedents, Meta Platforms was fined $5 billion by U.S. regulators in 2019 over a data misuse scandal.
The upcoming decision could mark one of the largest data breach penalties in South Korea, depending on how regulators weigh the severity of the incident against mitigating factors.
Alphabiz Reporter Kim Jisun(stockmk2020@alphabiz.co.kr)
