South Korea fines Coupang $408m over biggest data leak in country’s history

South Korea's Personal Information Protection Commission has fined e-commerce giant Coupang $408 million for a data leak that exposed the personal information of over 33 million customers. The commission stated that the leak resulted from Coupang's lack of safety measures and systems, not sophisticated hacking, and that the company delayed reporting the breach beyond the legally required 72 hours. This delay prevented affected individuals from taking steps to prevent secondary harm. Coupang has apologized for the concern caused but plans to challenge the fine in court, arguing that its proactive measures were not sufficiently reflected in the regulator's decision. This penalty is the largest ever imposed for a data leak in South Korea.

South Korea has fined e-commerce giant Coupang a record US$409 million for a data breach that exposed the personal information of over 30 million customers. The Personal Information Protection Commission announced the fine, totaling 624.68 billion won, for violating safety obligations and collecting personal data without legal grounds. The commission cited inadequate safeguards, including poor management of authentication keys and lax access controls, as the cause of the leak affecting approximately 37.5 million users. This decision concludes a months-long investigation into the US-incorporated online retail platform, which began after allegations of the data leak surfaced in November. The commission also stated that Coupang failed to notify affected individuals within the required 72-hour timeframe.