South Korea’s data protection regulator has fined e-commerce giant Coupang a record 624.7 billion won, or about $410 million, over serious privacy violations linked to a massive data breach that affected more than 37 million users.
The Personal Information Protection Commission said it will impose a 423.6 billion won fine for the data breach itself, along with an additional 201.1 billion won penalty for the unauthorised collection of users’ online activity records and other privacy violations.
The decision marks the highest fine ever issued by the regulator against a company for a single data breach and multiple privacy-related violations, according to Yonhap News Agency.
Coupang reported the large-scale data breach last November, saying that personal information of users in South Korea had been exposed. The leaked data included names, phone numbers and delivery-related details.
After its investigation, the regulator concluded that around 37.5 million users were affected. This included about 33.2 million Coupang members and 4.3 million non-member users.
Song Kyung-hee, chief of the watchdog, said Coupang had grown rapidly by using large amounts of customer information to build its e-commerce service, but failed to create a strong enough system to protect and manage that data properly.
The penalty is more than three times higher than the regulator’s previous record fine of 134.8 billion won, which was imposed on wireless carrier SK Telecom last August over a major data leak.
The regulator also found that Coupang collected online activity records from 11.17 million users without proper permission. These records included details about websites and applications visited by users while accessing other services.
Authorities also determined that Coupang failed to properly manage advertising partners that posted “hijacking” advertisements.
Separately, Coupang’s logistics unit, Coupang Fulfillment Services, was fined 248 million won for several privacy violations. These included collecting a list of journalists and keeping them on an employment restriction list.





