South Korea's Personal Information Protection Commission (PIPC) has imposed its largest-ever penalty on a single company: 624.681 billion won (about $409 million) against Coupang, the country's dominant e-commerce platform, following a breach that exposed the personal data of roughly 37.5 million people — well over two-thirds of South Korea's population. The commission's plenary session reached its decision on June 10, 2026, and announced it publicly the next day.
What Actually Happened
The breach did not stem from a sophisticated external attack. According to the PIPC, a former Coupang IT employee who had helped build the company's authentication signature-key system retained the ability to access it after leaving the company at the end of 2024. Between roughly April and November 2025, that former employee made an estimated 148 million access attempts against Coupang's delivery-management pages, harvesting names, phone numbers, addresses, and order histories. Coupang did not detect the intrusion internally — it surfaced only after customer complaints, and public disclosure followed in November 2025. The PIPC's investigation confirmed 33,222,472 registered members were affected, plus at least 4,338,368 non-members whose information had been stored as delivery contacts by other users (The Record).
The commission's own framing is pointed: this was not "advanced hacking" but a failure of "basic safety management" — Coupang allegedly let more employees than necessary view signing keys in plaintext and never revoked or rotated the key after the responsible employee's departure (fnnews.com).
The Fine Isn't Just About the Breach
What makes this penalty notable isn't only its size but its composition. Of the total, 423.575 billion won was levied for security-duty violations tied directly to the breach. But a separate 201.106 billion won was imposed for something unrelated to the hack itself: Coupang's alleged unlawful collection of online activity records from roughly 11.17 million members who visited other companies' websites and apps, gathered and stored without the legally required consent (fnnews.com). A smaller 248 million won penalty also hit subsidiary Coupang Fulfillment Service for mishandling police-corps and employee health data. The PIPC additionally cited delayed breach notification, interference with the independence of Coupang's data protection officer, and obstruction of the investigation through document deletion.
That bundling matters for how the fine should be read. It is not purely a security-negligence penalty — a meaningful share of it punishes a separate, longstanding practice of ad-adjacent data collection that many platforms globally have treated as a gray area. Regulators conflating the two into one headline number makes it harder to know whether South Korean platforms are being told "harden your systems" or "stop tracking users across the web without consent" — two very different compliance asks with different price tags attached.
The Case for the PIPC's Approach
The strongest argument for a fine this large is straightforward: proportionality to harm and to Coupang's scale. Coupang is a public company with tens of billions of dollars in annual revenue and effectively serves as critical infrastructure for Korean e-commerce; a fine that a smaller firm would experience as existential is, for Coupang, a cost of doing business unless it's large enough to bite. The commission also has precedent-setting reasons to go big — its previous record, 134.8 billion won against SK Telecom for a 2025 SIM-authentication breach affecting 23.2 million subscribers, evidently wasn't a strong enough deterrent to prevent a second mega-breach at a different major platform within the same year (PIPC). If access-control basics — key rotation on employee departure, least-privilege access to signing credentials — are still being neglected by South Korea's largest platforms, a regulator escalating penalty size is a defensible response to a pattern, not a one-off.
Where Proportionality Gets Harder to Defend
Even granting that argument, folding the unconsented-collection violation into the same enforcement action as the breach makes the total figure harder to evaluate on its merits. A 423.6 billion won penalty for security negligence that exposed 37.5 million people's data is a coherent, defensible number tied to demonstrable harm. A 201.1 billion won penalty for data collection practices — practices the PIPC apparently found ongoing and separate from the hack — deserved its own public reckoning on its own facts, not a ride-along inside the breach headline. Bundling both into a single record-breaking figure makes for a cleaner press release, but it obscures which behavior firms actually need to fix, and it makes the total penalty look more punitive than a careful reading of its parts would suggest.
The deeper policy question is whether South Korea's platforms will now treat authentication-key hygiene as seriously as, say, financial controls — or whether a $409 million fine simply becomes an annual-report line item. Coupang has said it will review the ruling; if it appeals, as SK Telecom did with its own PIPC fine in January 2026, the resulting administrative court record will do more to clarify what "basic safety management" legally requires than the commission's press statement does today.