Overview
- The Personal Information Protection Commission announced the fine on Thursday after concluding a breach exposed about 37.5 million users and that roughly 11.17 million users had their off‑platform activity collected without consent.
- Investigators said the leak stemmed from internal failures, including poor management of an authentication signing key allegedly stolen by a former employee, and that the company failed to detect or notify regulators within required timeframes.
- The commission split the penalty into roughly 423.6 billion won for the data breach and 201.1 billion won for unauthorized tracking, and it separately fined Coupang Fulfillment Services 248 million won for other privacy violations.
- Coupang apologised, said it will seek judicial review and will recognise the estimated fine in its 2026 second‑quarter results, while the company defends some of its mitigation steps and disputes aspects of the regulator's findings.
- The ruling is South Korea's largest data‑protection penalty, expands the company's financial and remediation burden beyond its customer compensation plan, and has prompted diplomatic pushback from some U.S. lawmakers while ordering operational fixes and greater independence for the firm's privacy officer.