South Korea Fines Coupang Record $400M Over Massive Data Breach
Quick Look
South Korea's Personal Information Protection Commission (PIPC) has fined Coupang, the country's largest e-commerce platform, a record 624.68 billion won (over $400 million) following a massive data breach that exposed the personal information of over 30 million customers.
AI-generated summary
Why It Matters
South Korea's Personal Information Protection Commission (PIPC) has imposed a record fine on online retail giant Coupang following a massive data breach. The breach exposed the data of over 30 million customers, representing more than half of the country's population.
South Korea has hit online retail giant Coupang with a record fine of more than $400m (£299m) over a massive data breach that exposed the data of more than 30 million customers last year.
The fine is the largest ever issued by Seoul's Personal Information Protection Commission (PIPC) for a data breach.
The leak exposed the names, contact and delivery details and order histories of some customers of Coupang, South Korea's largest e-commerce platform often described as its equivalent of Amazon.
Coupang told the BBC it "deeply regrets the concern caused" and that it will strengthen its security measures, but added that it planned to challenge the PIPC decision.
The number of accounts affected by the incident represents more than half of South Korea's population of around 50 million people.
The PIPC on Wednesday announced the fine of 624.68bn won on Coupang "for violating safety obligations and collecting personal data without legal grounds."
The commission found that a lack of safeguards, including poor management of authentication signing keys and access controls, had resulted in the personal data of around 37.5 million users being exposed.
Coupang said that its explanations and measures to prevent further harm from the data breach "were not sufficiently reflected" in the commission's decision.
"Upon receiving the official resolution from the PIPC, we expect that the facts will be clearly established through legal procedures," said Coupang.
The decision follows a months-long probe into Coupang after allegations of the data leak surfaced in November.
The company is based in the US, but the majority of its revenue comes from South Korea.
Coupang told the BBC at the time that it was alerted to a breach involving 4,500 customer accounts in November and immediately reported it to the authorities.
But the company said that later checks found that nearly 34 million customer accounts - all in South Korea - were likely exposed. It added that the breach is believed to have begun as early as June through a server based abroad.
What to Watch
AI outlook — possibilities, not facts
Coupang will likely launch a formal legal challenge against the PIPC decision.
Very likely · Within weeks
Coupang's stock price may experience a short-term decline following the announcement of the fine.
Likely · Within days
Coupang will implement enhanced cybersecurity measures.
Very likely · Within months
Open Questions
- What specific legal procedures will Coupang undertake to challenge the decision?
- What are the exact security measures Coupang plans to implement to prevent future breaches?
- Will there be any further regulatory actions or investigations into Coupang's data handling practices?
- What is the estimated financial impact of the fine on Coupang's profitability?
