Anchor
South Korea fines Coupang record sum over data breach
Rule ChangesA former engineer's retained signing key exposed data on most of the country, and the privacy regulator answered with the largest fine in its history.
June 11th, 2026: Record $409 million fine imposedNew here? Follow stories to track developments over time. Create a free account to get updates when stories you care about change.
Overview
Updated Jun 12South Korea's privacy regulator fined Coupang 624.7 billion won, roughly $409 million, for a breach that exposed data on 37.5 million accounts, more than 70% of the country's population. The penalty is the largest in Korea's privacy enforcement history. It landed below analyst projections of up to 1 trillion won, and Coupang shares jumped 14% on June 11, their best single-day gain since November 2022.
The regulator blamed weak security rather than sophisticated hacking: a former engineer kept a signing key after leaving, forged login tokens, and accessed customer systems undetected for months. Coupang is challenging the fine in the Seoul Administrative Court, though Korean law does not stay payment during an appeal. A separate 248 million won fine also hit Coupang's logistics arm for blacklisting police press corps journalists and submitting workers' health records to courts without consent.
Why it matters
If you shopped on Korea's biggest online store, your name, address, phone, and order history were likely exposed, and the company that held them is contesting the bill.
Questions about this story
Free account needed to ask — your question is kept and asked for you right after sign-up. Answers are public.
No questions yet — be the first to ask.
Key Indicators
$409M
Total fine
Largest data-privacy penalty in South Korean history.
37.5M
Accounts exposed
More than 70% of South Korea's population.
11.17M
Users tracked without consent
Online activity collected across third-party sites and apps.
~7 months
Undetected access
Intruder had access from mid-April to early November 2025.
$1.2B
Compensation pledged
Coupang's 1.7 trillion won plan to restore customer trust.
Related Media
Coupang, Mar 11, 2021 : The headquarters of South Korean e-commerce firm Coupang (C) in Seoul, South Korea. Coupang that describes itself as the Amazon of Korea, said on March 11 its
Coupang, Mar 11, 2021 : The headquarters of South Korean e-commerce firm Coupang in Seoul, South Korea. Coupang that describes itself as the Amazon of Korea, said on March 11 its initial
Coupang Faces 624.7 Billion Won Privacy Fine, Plans Legal Challenge < IT·Gaming < 기사본문 - The Elec Inc.
423 views
1:08
South Korea fines Coupang in country's largest data breach ...
Reuters
5.4K views
48:09
South Korea fines Coupang US$408m after data leak | East ...
CNA
68 views
0:38
Record 624.7 bil. won fine imposed on Coupang for massive ...
Arirang News
Images from Openverse under Creative Commons licenses. Videos from YouTube.
Voices
Curated perspectives — historical figures and your fellow readers.
Play
Exploring all sides of a story is often best achieved with Play.
Most of these play right now — no account needed. Sign up to save scores, keep a streak, and unlock Debate and Predict.
Log in
Sign Up
Higher or Lower
A number from this story, against one from elsewhere in the news — guess which is bigger, then keep the chain going. 5 rounds, 3 strikes; a miss costs a strike and resets your streak.
Example
Anchor
EU tariff revenue
$52B
Big for this kind of number
Mystery
Pentagon AI contract
?
Round 1
Streak: 0
Mystery
?
Keyboard: ↓/L lower · ↑/H higher
0 pts
Best streak: 0 · Rounds: 0
0 points — sign up to put that on the leaderboard.
Now try on this story
Timeline
South Korea fines Coupang record sum over data breach
Order five events from this story, oldest at top. Each in the right slot scores 1 — neighbours within one slot count too. Your previous result — green ✓ for exact slots, yellow ~ for off by one. Cards now in true chronological order.
Loading puzzle…
Tap 💡 Free hint to lock the oldest into slot 1 — that leaves just four to order. Type pills are clues.
0/5
Exact slot
0/5
Within 1
Sign up to save your score and track a streak across stories.
Now try on this story
Connections
Sixteen names from the news. Find the four hidden groups of four. Four mistakes max.
Loading today's puzzle…
0/4 groups
Mistakes
Sign up to keep a daily streak — a new puzzle lands every day.
Now try on this story
Exit debate?
Your progress in this debate will be lost.
How it works
- 1 Two AI personas square off on this story.
- 2 You predict who'll win each round — correct picks earn XP.
- 3 One crossfire question is yours to fire. Pick it carefully.
Couldn't generate a topic
Select Your Champions
Choose one persona for each side of the debate
DEBATE TOPIC
Choose personas with different perspectives for a more dynamic debate.
SIDE A (PRO)
Select debater for this side:
No debate personas available right now.
SIDE B (CON)
Select debater for this side:
No debate personas available right now.
VS
Get ready to make your prediction...
Round of
Claim
Evidence
Stakes
Crossfire Answer
Closing Statement
Claim
Evidence
Stakes
Crossfire Answer
Closing Statement
Your Crossfire Question
Generating arguments...
Who's Got This Round?
Make your prediction before the referee scores
The referee scores both sides on
Correct predictions earn +20 XP
· Press 1 or 2 to pick
Evidence
40%
Logic
30%
Detail
20%
Style
10%
Round Results
Your Pick
Not this time
(%)
Overall Score
/10
Your Pick
Not this time
(%)
Overall Score
/10
Set the Crossfire
Pick the question both personas must answer in the final round
Crafting crossfire questions...
Choosing a question earns +10 XP crossfire bonus
🏆
Total XP Earned
Cred Change
Predictions
Debate Oracle! You called every round!
Sharp Instincts! You know your debaters!
The Coin Flip Strategist! Perfectly balanced!
The Contrarian! Bold predictions!
Inverse Genius! Try betting the opposite next time!
XP Breakdown
Base completion
+20 XP
Rounds played ( rounds x 5 XP)
+ XP
Correct predictions ( correct x 20 XP)
+ XP
Crossfire bonus
+10 XP
Accuracy
%
Prediction History
Round
You picked:
✓
✗
Now try on this story
Keep debating to level up your credibility and unlock achievements
People Involved
Song Kyung-hee
Chairwoman, Personal Information Protection Commission
Led the enforcement action and public findings
Bom Kim
Founder and Chief Executive, Coupang
Apologized publicly; company is contesting related rulings
Harold Rogers
Interim Chief Executive, Coupang
Represented Coupang before US lawmakers
Organizations Involved
Coupang
E-commerce Company
Fined; challenging ruling in Seoul Administrative Court while paying fine during appeal
South Korea's largest online retailer, listed on the New York Stock Exchange and headquartered in part in Seattle.
Personal Information Protection Commission
Federal Privacy Regulator
Issued the fine
South Korea's data-privacy regulator, with power to investigate breaches and levy penalties.
Timeline
November 2024 June 2026
13 events
Latest: June 11th, 2026 · 2 months ago
Showing 8 of 13
Tap a bar to jump to that date
-
Record $409 million fine imposed
Latest LegalThe PIPC fines Coupang 624.7 billion won, splitting it between the leak and unauthorized tracking of 11.17 million users. Coupang vows to appeal.
-
Coupang shares jump 14% as fine lands below worst-case
MarketCPNG closed up 14%, its best single day since November 2022, after the 624.7 billion won fine came in well below the roughly 1 trillion won ceiling analysts had feared. Morgan Stanley maintained its Overweight rating at a $28 price target, saying the penalty was in line with its $400 million estimate and removed a major overhang on the stock.
-
Coupang files 8-K; fine to hit Q2 operating results
RegulatoryCoupang disclosed the fines in an 8-K filing with the US Securities and Exchange Commission. The roughly $410 million charge will be recorded in Q2 2026 operating expenses and is not deductible for income tax. The company noted it had not yet received PIPC's formal written decision and confirmed it will pursue judicial relief in the Seoul Administrative Court.
-
Logistics unit fined separately for journalist blacklist
LegalThe PIPC imposed a separate 248 million won fine on Coupang Fulfillment Services for collecting personal data on 71 police press corps journalists without authorization and registering them on an internal employment restriction list. The subsidiary was also cited for submitting workers' weight and health records, gathered for employee wellness purposes, to courts without consent during industrial accident litigation.
-
US investors withdraw Section 301 petition
TradeGreenoaks Capital Partners and Altimeter Capital withdrew their January 2026 petition asking the US Trade Representative to investigate South Korea's treatment of Coupang. The firms said broader US trade probes already under way would address the same concerns more effectively. A separate investor-state dispute settlement claim under the US-Korea Free Trade Agreement remains pending.
-
Korean ministry calls it a management failure
InvestigationThe Ministry of Science and ICT concludes the breach stemmed from poor management, not a sophisticated cyberattack.
-
US investors file trade petition
TradeTwo US investment firms file a Section 301 petition with the US Trade Representative, alleging discrimination against American companies.
-
Coupang pledges $1.2 billion compensation
ResponseThe company announces a 1.7 trillion won plan to compensate affected customers and rebuild trust.
-
Scale revealed: 33.7 million accounts
DisclosureCoupang publicly discloses that roughly 33.7 million user accounts were compromised in the breach.
-
Breach reported late to authorities
RegulatoryCoupang notifies regulators more than 53 hours after discovery, past the required reporting window.
-
Coupang discovers the intrusion
DetectionThe company finds the unauthorized access after the former employee sends threatening anonymous emails. Initial estimate: about 4,500 accounts.
-
Unauthorized access begins
BreachThe former engineer allegedly forges authentication tokens and starts accessing customer systems, continuing into November.
-
Engineer leaves with access to signing key
OriginA Coupang engineer who helped build a backup authentication system departs the company, retaining an internal signing key.
Historical Context
3 moments from history that rhyme with this story — and how they unfolded.
September 2017
Equifax data breach (2017)
Attackers exploited an unpatched flaw at credit bureau Equifax and exposed sensitive data on about 147 million Americans. The cause was a known vulnerability left unfixed, not a novel hack.
Then
Equifax's CEO resigned and the company faced a wave of investigations and lawsuits.
Now
A 2019 settlement reached up to $700 million, becoming a reference point for breach penalties tied to basic security lapses.
Why this matters now
Like Coupang, Equifax was punished for preventable failures rather than sophisticated attacks, and both fines turned on negligence.
May 2023
Meta GDPR fine over data transfers (2023)
Ireland's privacy regulator fined Meta 1.2 billion euros over transfers of European user data to the US, the largest penalty under the EU's data-protection law at the time.
Then
Meta was ordered to suspend the transfers and given a deadline to comply.
Now
The case showed regulators willing to impose record fines on global tech firms and to treat data handling as a sovereignty issue.
Why this matters now
Both cases show national regulators using record fines against large platforms, and both raised cross-border friction over data.
2025
SK Telecom data breach fine (2025)
South Korea's largest mobile carrier suffered a breach and drew an $88 million penalty, then the biggest privacy fine in the country. Regulators cited weak safeguards over subscriber data.
Then
The fine set the prior national ceiling for privacy penalties and pushed carriers to harden systems.
Now
It established that Korean regulators would scale fines to the size of the data holder, setting up an even larger Coupang penalty.
Why this matters now
Coupang's fine is more than four times the SK Telecom mark, showing how fast Korea's privacy penalties are climbing.
Sources
(18)Related Stories
South Korea directs $880 billion private buildout into chips and AI data centers
Money Moves
Updated Aug 9
Federal Trade Commission settles with Match Group over OkCupid's secret data pipeline to a facial recognition firm
Rule Changes
Updated May 30
International enforcement closes in on Southeast Asia's largest crypto fraud network
Rule Changes
Updated May 30
Swedish court orders Google to pay damages for search self-preferencing
Rule Changes
Updated Jul 1
South Korea forces AI-generated ads to wear labels
Rule Changes
Updated May 10
South Korea fires its top cop for backing Yoon’s martial-law bid
Rule Changes
Updated May 15