On 5 November 2026, Administrative Division 4 of the Seoul Administrative Court, presided over by Judge Kim Young-min, partly granted Coupang's stay application. It found "no recognized need" to suspend the 423.6 billion won surcharge the Personal Information Protection Commission (PIPC) imposed over a leak affecting about 37.5 million people. It did suspend the corrective order and the public-disclosure order, because they risk "irreparable damage" to Coupang. They stay suspended until 30 days after the merits ruling. This is an interim decision. Whether the penalty was lawful is still undecided.
The case for the regulator is strong
The strongest argument for the PIPC deserves a fair hearing. The PIPC's June 2026 decision describes a breach reported on 20 November 2025. The intruder was a former employee who held authentication signing keys. The data exposed covered about 33.22 million Coupang users, plus about 4.33 million third parties whose shipping information leaked. That is roughly 37.5 million people. Deterrence matters when a platform holds the delivery addresses of most of a country.
The conduct after the breach also counts. According to JoongAng Daily, Coupang manually deleted five months of access logs after a preservation order was issued. Records covering 13 percent of the intruder's activity were lost. The PIPC also said notification to about 160,000 individuals came after the 72-hour deadline. A regulator that cannot reconstruct an incident cannot protect the public. Penalising evidence loss and late disclosure is legitimate, and it is the part of this case that the market should take most seriously.
What the court actually decided
The split outcome is informative. The reported reasoning, as SBS reported it, is that the corrective order and the disclosure order could cause damage that cannot easily be undone. A money penalty can be refunded if Coupang wins on the merits. The corrective order covers stronger safeguards, notifying data subjects who are not members, and making the Chief Privacy Officer role effective. Changes to live systems and public statements are harder to reverse.
That leaves an awkward result. The parts of the PIPC's decision aimed at fixing security are paused for months, while the money is payable. Some of those orders protect users, so the pause has a cost. The sequencing is a design problem for the enforcement system, not a flaw in the court's logic. If remedial duties can be suspended for the length of litigation, regulators should consider splitting urgent security measures from punitive ones. The rationale for pausing the disclosure order is reasonable. Where users are at ongoing risk, suspending the safeguards order is harder to defend.
The proportionality problem is real
The fine totals 624.7 billion won across two lawsuits. Of that, 423.6 billion won is for the breach and 201.1 billion won is for unauthorised collection of online activity records and other violations. Coupang challenged both in October. The Korea Times reported in June that the breach penalty is more than four times the previous record of 134.8 billion won, imposed on SK Telecom. By comparison, a breach of more than 427,000 members at Duo drew only 1.2 billion won. Those gaps are partly explained by size and severity. They also show how wide the discretion is.
Under the revenue-based formula, penalties are calculated from average revenue over the previous three years. Severity brackets run from 0.9 percent to 3 percent. Coupang reports about 36 trillion won in average annual sales. That is a large base, and a bracket choice moves the result by hundreds of billions of won. A framework that lets a regulator's classification of severity swing a penalty by an order of magnitude is not predictable. Predictability is what lets companies budget for security instead of litigation.
The PIPC's own release, which lists the legal provisions it applied, is the right place to look for how those brackets were chosen. A penalty should also reflect what actually went wrong. In this case, that means the failure to hold logs and to notify promptly, together with a credential-control failure by an insider. It should not simply reflect how many users the company has. Scale-driven penalties teach firms that holding fewer customers is safer than holding data well.
The pro-innovation reading
None of this argues for leniency toward firms that destroy evidence. A pro-innovation position supports accountable data stewardship, because trust is what lets digital commerce grow. But proportionate enforcement has three requirements the Korean system should meet:
- Published severity methodology. The PIPC should state how it places a case in a bracket, with worked examples, so firms can price the risk before an incident.
- Separate tracks for remediation and punishment. Urgent security measures should not wait for years of litigation, and punitive amounts should not be set by the same bargaining logic.
- Credit for cooperation, and penalties for obstruction. The difference between a breach and a cover-up should be visible in the number.
There is also a trade-policy edge. The October Korea Times report noted that the leak became a source of friction between Seoul and Washington, as some US officials and lawmakers questioned whether Coupang's Korean unit was treated unfairly. Transparent, rules-based enforcement is the best protection against such claims. It also protects domestic firms from the next large case.
What to watch
The merits trial has no date yet. Three points will matter when it comes. First, whether the court tests the PIPC's severity classification or defers to it. Second, how it treats the 201.1 billion won collection penalty, which rests on a different legal theory than the breach penalty. Third, whether it sets any limit on a penalty derived from user numbers. For now, the money stays due and the remedies wait. That is a defensible interim outcome. It is a poor template for how Korea should regulate data security over the long run.