Coupang fined KRW 624.7B, Korea's largest privacy sanction
₩624.7B
≈ $457M at the time
Personal Information Protection Commission
South Korea · 2026
Status: Under appeal
What happened
The PIPC found that a 2025 breach at Coupang, carried out by a former employee using authentication signing keys the company had not revoked, stemmed from basic security failures rather than sophisticated hacking, and that Coupang notified it late. Separately, it found that Coupang collected the online behaviour of about 11.17 million users on other websites and apps without consent.
The total is the sum of two penalty surcharges (gwajinggeum): KRW 423.575B for the breach and KRW 201.106B for the behavioural-data collection. The separate KRW 16.8M administrative fine (gwataeryo) and a KRW 248M penalty on the logistics subsidiary Coupang Fulfillment Services are not included. The release reposted on Korea.net is the PIPC's own unofficial English translation.
How it affected users
Names, email addresses and shipping details of about 33.22 million Coupang users leaked, along with names, phone numbers, addresses and building access passwords of about 4.33 million other people listed in delivery details. People who visited other websites and apps carrying Coupang Partners ads had the URLs they visited, IP addresses and device identifiers recorded without being told.
Status timeline
Jun 10, 2026
The PIPC's plenary meeting resolved to impose KRW 423.575B for safeguard failures and KRW 201.106B for unlawful collection of behavioural data, plus a KRW 16.8M administrative fine and correction orders.
Oct 8, 2026
Coupang was reported to have filed two suits at the Seoul Administrative Court seeking to overturn the penalties.
Sources
- PIPC press release (via Korea.net): The PIPC sanctions Coupang and CFS for data breaches and infringements on privacyregulator
- Korea JoongAng Daily: Coupang sues to overturn $462 million fine over data leaknews
- The Korea Times: Coupang files lawsuits against 620 bil. won fine over data leaknews
Last verified 2026-10-15. Spotted an error? Report a correction.
Cite this entry
Deepak Gupta, "Coupang fined KRW 624.7B, Korea's largest privacy sanction," Tech Fines Directory, guptadeepak.com, 2026-06-11. https://guptadeepak.com/tech-fines/violation/coupang-southkorea-pipc-2026/