South Korea fines Coupang 624.7 billion won for breach

South Korea's data protection regulator has imposed a record fine of 624.7 billion won, approximately $409 million, on e-commerce giant Coupang for a massive data breach and unauthorized tracking of user activity. The penalty, announced on Thursday, June 11, 2026, by the Personal Information Protection Commission (PIPC), is the largest ever levied in the country for a privacy violation.

The fine stems from two primary violations. The first, and largest component of the penalty at 423.58 billion won, addresses a data breach that compromised the personal information of between 33 million and 37.5 million users. A government-led investigation earlier this year concluded that a former Coupang employee, a Chinese national, exploited internal security lapses—specifically poor management of authentication keys—to gain unauthorized access to customer accounts over several months starting around April to June 2025. The exposed data included names, email addresses, phone numbers, physical addresses, and order histories, though payment data and passwords were reportedly not compromised.

The PIPC stated the breach was caused not by sophisticated hacking but by Coupang's inadequate safety...