South Korea’s Personal Information Protection Commission (PIPC) has dropped the hammer on e-commerce giant Coupang with a staggering 624.7 billion won (\$409 million) fine — the largest data breach penalty in the country’s history. The announcement, made on June 11, 2026, stems from a massive leak of over 33 million customer records and the illegal collection of online activity data from approximately 11 million users.
The PIPC investigation found that a former Coupang employee stole a cryptographic signing key and gained unauthorized access to customer data from overseas servers. The intrusion ran undetected for nearly five months, from June to November 2025. Compromised data includes names, email addresses, phone numbers, shipping addresses, and order histories, though payment credentials were reportedly unaffected. Coupang also caught a separate penalty for blowing the legally mandated 24-hour breach notification window — they took 48 hours to report the incident to regulators after first detecting suspicious activity.
The fine dwarfs the previous South Korean record of 134.8 billion won levied against SK Telecom. Coupang has apologized but is reportedly reviewing legal options to challenge the ruling.
Sources
- Al Jazeera — South Korea fines Coupang \$408M
- The Next Web — Coupang \$409 million data breach fine
- Korea Herald
Commentary
This is a landmark moment for data protection enforcement in Asia. The sheer scale of the fine — triple the previous record — sends a clear message that regulators are done issuing slaps on the wrist. The fact that the breach was caused by an insider with a stolen signing key, not a sophisticated external attack, makes it especially damning. It’s a failure of access controls 101: key management, monitoring, and least-privilege access.
The 48-hour notification delay is also notable. South Korea’s 24-hour reporting window is one of the strictest in the world, and Coupang’s failure to meet it drew a separate penalty. Companies operating in jurisdictions with tight disclosure timelines need to have their incident response playbooks drilled and ready to go — fumbling the notification after a five-month-long undetected breach is not a good look.