Coupang hit with record $409 million data breach fine in Korea
Home<br>News<br>Security<br>Coupang hit with record $409 million data breach fine in Korea
Coupang hit with record $409 million data breach fine in Korea
By Sergiu Gatlan
June 11, 2026
08:52 AM
The Personal Information Protection Commission (PIPC), South Korea's data protection regulator, has fined e-commerce giant Coupang a record 624.6 billion won (roughly $409 million) following a massive data breach affecting more than 37 million customers.
Subsidiary Coupang Fulfillment Service was also fined 248 million won for unlawfully collecting, using, and handling customers' personal and sensitive data.
The investigators also found that the personal information of approximately 37.55 million people was leaked due to inadequate security practices, including failures in authentication key management and access controls.
PIPC also cited violations of data destruction and leak-notification requirements, interference with the independence of Coupang's data protection officer, and obstruction of the investigation.
"Personal information of approximately 37.55 million people leaked due to insufficient basic safety management system, including negligence in authentication signature key management and access control," the PIPC said. "Regarding Coupang's violation of safety measure obligations and collection of personal information without legal basis, a fine of 624.681 billion won and a fine of 16.8 million won were imposed, as well as corrective orders, announcements, and publication orders."
Coupang is an American online retail company that operates in the South Korean market, employs 95,000 people, and has reported annual revenue exceeding $30 billion.
The company announced plans in late December to pay 1.685 trillion won (approximately $1.17 billion) and to start distributing single-use purchase vouchers totaling 50,000 won (about $34) per customer in January 2026 to compensate over 33 million affected customers.
This breach, one of the worst in South Korea's history, occurred in late June but was discovered only in mid-November, when the company warned that 33.7 million accounts had been compromised.
According to South Korean authorities, which took over the investigation, the primary suspect is a 43-year-old Chinese national who worked in Coupang's IT department between 2022 and 2024.
Coupang later said that the former employee returned multiple hard drives containing sensitive data. The suspect also disposed of a MacBook Air laptop in a river in an attempt to destroy evidence, but the device was recovered. Coupang also added that the suspect retained user data for approximately 3,000 accounts, even though they accessed millions of accounts, and that this data was deleted from all devices and not transferred to others.
SK Telecom, South Korea's largest mobile network operator, also warned customers in April that sensitive USIM data had been exposed after its network was infected with malware. The company later revealed the malware was first deployed on its systems in June 2022, affecting a total of 27 million subscribers (representing SK Telecom's almost entire customer base).
Test every layer before attackers do
Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.<br>The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.
Get the whitepaper
Related Articles:
UK fines LastPass over 2022 data breach impacting 1.6 million users<br>Nottingham University data breach affects over 450,000 students<br>ServiceNow discloses security incident exposing customer data<br>French govt messaging service breached in account hijacking attack<br>SoFi confirms third-party data breach at Hong Kong subsidiary
Coupang
Data Breach
Fine
South Korea
Sergiu Gatlan
Sergiu is a news reporter who has covered the latest cybersecurity and technology developments for over a decade. Email or Twitter DMs for tips.
Previous Article
Next Article
Post a Comment Community Rules
You need to login in order to post a comment
Not a member yet? Register Now
You may also like:
Upcoming Webinar
Popular Stories
ServiceNow discloses security incident exposing customer data
Microsoft June 2026 Patch Tuesday fixes 6 zero-days, 200 flaws
Microsoft Defender 'RoguePlanet' zero-day grants SYSTEM privileges
Sponsor Posts
Your AI tools are leaking sensitive data. Get a free audit.
Overdue a password health-check? Audit your Active Directory for free
What security leaders should prepare for over the next six months.
AI-driven threats are outpacing MSP security operations. Join the partner community.
Build cyber resilience with Wazuh: The open-source SIEM & XDR for proactive protection
Upcoming Webinar
Login
Username
Password
Remember Me
Sign in anonymously
Sign in with Twitter
Not a member yet? Register Now
Reporter
Help us understand the...