Overview
- The Personal Information Protection Commission issued the record 624.68 billion won penalty on Thursday, June 11, 2026, splitting 423.58 billion won for the breach and 201.1 billion won for unlawful tracking.
- Regulators concluded about 37.5 million users had personal information exposed, including roughly 33.2 million members and 4.3 million non‑members.
- The commission found that an insider stole a cryptographic signing key and that poor key management, lax access controls and delayed breach reporting allowed the leak to continue.
- The PIPC also ruled that Coupang collected online activity records for about 11.17 million users without consent and separately fined Coupang Fulfillment Services 248 million won for other privacy violations.
- Coupang apologized and said it will challenge the ruling in court; the fine raises the company’s near‑term financial exposure when added to its customer compensation plan and has strained ties between Seoul and U.S. lawmakers.