- Company
- Coupang
- Regulator or court
- Personal Information Protection Commission (PIPC)
- Law
- Personal Information Protection Act
- Status
- Contested – Coupang said the fines are not final and it will seek relief in the Seoul Administrative Court
What happened
A former Coupang employee misused poorly managed authentication keys to access customer accounts, exposing data on roughly 33–37 million people in 2025. The regulator fined the e-commerce company about KRW 423.6 billion for the leak and a further KRW 201.1 billion for collecting users' activity on other sites and apps without a legal basis, and said the incident was caused by weak safeguards rather than sophisticated hacking.
Sources
TechRepublic – Coupang record fineKorea Herald – Coupang vows to seek judicial reliefDigital Policy Alert – PIPC proceedings against CoupangSummary in our own words. General information, not legal advice.