South Korea imposes record $410 million fine on Coupang over data breach

South Korea's data protection watchdog has imposed a record 624.7 billion won ($410 million) fine on e-commerce giant Coupang over a massive data breach and multiple privacy violations affecting tens of millions of users.

The Personal Information Protection Commission (PIPC) announced on Thursday that Coupang would pay 423.6 billion won for a large-scale data leak disclosed last November, along with an additional 201.1 billion won for the unauthorised collection of users' online activity records and other breaches of privacy regulations.

The penalty is the largest ever imposed by the regulator for a single data breach and related violations, surpassing the previous record fine of 134.8 billion won levied against telecom operator SK Telecom in 2025.

"Coupang is a company that grew dramatically by offering an innovative e-commerce service based on large-scale customer information," PIPC Vice Chairperson Song Kyung-hee said. "But our investigation confirmed that it did not have a system to protect and manage personal information commensurate to that."

According to the regulator, the breach exposed personal data belonging to approximately 37.5 million users, including 33.2 million registered members and 4.3 million non-members. Compromised information reportedly included names, phone numbers and delivery details.

The investigation also found that Coupang collected online activity records of about 11.17 million users without obtaining consent. The data included information on websites and applications accessed by users outside the company's platform.

In addition, the watchdog said Coupang failed to adequately supervise advertising partners responsible for posting so-called "hijacking" advertisements, exposing users to further privacy risks.

Separately, Coupang's logistics subsidiary, Coupang Fulfillment Services, was fined 248 million won for additional privacy violations. Regulators said the company maintained a list of journalists and included them on an employment restriction list, among other infractions.

The unprecedented penalty marks a significant escalation in South Korea's enforcement of data protection laws and serves as a warning to technology and e-commerce firms handling vast amounts of consumer information.

With IANS inputs