South Korea’s privacy regulator has imposed a record $408 million fine on e-commerce giant Coupang for failing to protect the personal data of over 33 million customers.

Key Points

• The Personal Information Protection Commission issued the penalty after finding Coupang failed to report a data breach within the mandatory 72-hour window.
• Regulators attributed the leak to inadequate internal safety measures and management failures rather than sophisticated external hacking.
• The breach involved a former employee who allegedly used a stolen security key to gain unauthorized access to customer accounts.
• This $408 million penalty is the largest ever issued for a data leak in South Korea, significantly surpassing the previous $88 million record.
• Coupang, which is listed on the New York Stock Exchange, has expressed regret but indicated it plans to challenge the fine in court.

Why it Matters

This record-breaking fine highlights the increasing regulatory scrutiny facing major e-commerce platforms regarding the management of vast consumer datasets. The case also underscores ongoing diplomatic tensions, as the investigation has sparked debate among US lawmakers over whether South Korean regulatory actions unfairly target American-listed companies.