South Korea Slaps Coupang with Record KRW 625 Billion Fine Over Massive Data Breach Affecting 33 Million Users

In a landmark enforcement action, South Korea’s Personal Information Protection Commission (PIPC) has imposed its largest-ever data breach fine on e-commerce giant Coupang. The penalty of KRW 624.68 billion (approximately $410 million USD) underscores the regulator’s growing intolerance for lapses in handling personal data, especially in one of the country’s most critical digital sectors. The fine, announced this week, stems from a major 2025 data breach that exposed the personal information of more than 33 million customers — roughly two-thirds of South Korea’s population. It highlights ongoing challenges in insider threats, access management, and timely breach detection in the fast-paced world of online retail.

The Coupang Data Breach

The incident came to light in late 2025 when Coupang disclosed that a former employee had stolen a security key and gained unauthorized access to customer accounts. The breach, which occurred around June 2025, was not promptly detected, violating South Korea’s strict 72-hour breach notification and response requirements. Exposed data included names, email addresses, phone numbers, postal addresses, and order histories for approximately 33.7 million registered users, plus data on millions of non-members whose information was stored as delivery recipients. Importantly, financial details and passwords were reportedly not compromised.

The Record Fine for Korean Data Breach

The total penalty of KRW 624.68 billion consists of multiple components:

• • KRW 423.5 billion for data breach violations, including failure to maintain adequate safety measures and delayed detection/response.

• • KRW 201.1 billion for unlawfully collecting and using personal data on users’ online activities across other websites.

• • Additional sanctions were issued against Coupang Fulfillment Services for related violations, such as creating an employment restriction list using personal information without proper grounds.

This represents about 1.4% of Coupang’s reported KRW 45 trillion revenue for 2025, marking a significant financial hit for the Seattle-based but South Korea-focused company.

PIPC’s Era of Enforcement in South Korea Has Started

The PIPC’s decision surpasses previous records, including a KRW 134.8 billion fine against SK Telecom earlier in 2026. It signals that regulators are cracking down hard on “deficiencies in basic safety management,” even when the breach originates from an insider rather than a sophisticated external hack. Coupang has issued an apology and is expected to cooperate fully, but the case raises broader questions about corporate accountability in handling vast troves of consumer data in Asia’s most digitized economies.

Prioritize Access Controls and Minimize Data Collection

This high-profile case offers critical takeaways for companies worldwide, especially those operating in or modeled after South Korea’s privacy framework (which shares similarities with GDPR and CCPA):

1. 1. Prioritize Robust Offboarding and Access Controls: Revoke all credentials, keys, and access immediately upon employee departure. Implement strict least-privilege principles and regular audits.

1. 1. Ensure Rapid Breach Detection and Notification: Invest in real-time monitoring, anomaly detection, and incident response plans that meet or exceed 72-hour requirements. Delays amplify penalties and erode trust.

1. 1. Minimize Unnecessary Data Collection: Only gather and retain what is strictly needed for business purposes. Avoid shadow data practices or cross-site tracking without explicit legal grounds.

1. 1. Account for Non-Members and Third-Party Data: Recognize that data belonging to delivery recipients or other indirect users still requires protection and transparency.

1. 1. Prepare for Insider Threats: These remain one of the most common and damaging vectors. Combine technical controls with strong organizational culture and training.

Broader Implications for Privacy Compliance and E-Commerce

As data protection authorities globally ramp up enforcement — from Europe’s GDPR fines to U.S. state actions and now Asia’s record penalties — organizations must treat privacy as a core business risk rather than a compliance checkbox. For e-commerce platforms like Coupang, which handle massive volumes of personal and transactional data, the stakes are particularly high. Consumers, meanwhile, are increasingly aware of these risks. The breach affecting such a large portion of South Korea’s population could accelerate demands for stronger data minimization, better consent mechanisms, and greater transparency in how companies safeguard sensitive information.