Coupang hit with record $409 million data breach fine in Korea
South Korean regulators fined Coupang a record $409 million for a massive data breach affecting over 37 million customers.
Intelligence analysis by Qwen 2.5 (3B)
E-commerce giant Coupang faces a record-breaking $409 million fine from South Korea's data protection regulator for a significant data breach impacting millions of users.
Coupang is a big online store that got into trouble for letting bad people take their customer information. The government said Coupang did a really bad job keeping the customer info safe and fined them lots of money, more than you can count on your fingers and toes!
Analysis
Overview
The Personal Information Protection Commission (PIPC) fined e-commerce giant Coupang a record $409 million for a massive data breach affecting over 37 million customers. The fine also included penalties against subsidiary Coupang Fulfillment Service.
Details of the Breach
Coupang's subsidiary, Coupang Fulfillment Service, was fined $248 million for unlawfully collecting, using, and handling customer personal and sensitive data. Approximately 37.55 million people had their personal information leaked due to inadequate security practices.
Regulatory Actions
The PIPC cited violations of data destruction requirements, leak-notification obligations, interference with the independence of Coupang's Data Protection Officer (DPO), and obstruction of the investigation process.
Investigation Findings
Investigators found that the breach was caused by a 43-year-old Chinese national who worked in Coupang's IT department between 2022 and 2024. The suspect returned multiple hard drives containing sensitive data to Coupang, but also disposed of a MacBook Air laptop in a river to destroy evidence.
Additional Context
The breach occurred in late June but was only discovered in mid-November when the company warned that over 33 million accounts had been compromised. SK Telecom, South Korea's largest mobile network operator, also warned customers about sensitive USIM data exposure due to malware infection in April.
Key points
- Coupang fined $409 million for a massive data breach affecting over 37 million customers
- Subsidiary Coupang Fulfillment Service also received penalties for handling customer data improperly
- The fine includes violations of data destruction and leak-notification requirements
- Investigators found that the breach was caused by a Chinese national who worked in Coupang's IT department
- Coupang is required to distribute single-use purchase vouchers to affected customers
This fine may encourage other companies to improve their cybersecurity practices and better protect user data.
The breach could lead to further security lapses or even more serious breaches in the future if not addressed properly.
