South Korea Fines Coupang $409 Million After Breach Exposed 37.55 Million Customers
Summary
South Korea’s PIPC fined Coupang a record 624.6 billion won (about $409 million) after finding a breach exposed roughly 37.55 million customers’ personal data, citing weak authentication key management and access controls.
Key points
- South Korea’s Personal Information Protection Commission imposed a record 624.6 billion won fine on Coupang over the breach.
- The PIPC said approximately 37.55 million people’s personal information was leaked, citing inadequate authentication key management and access controls.
- Coupang Fulfillment Service was fined 248 million won for unlawful collection, use, and handling of customer data.
- Authorities also cited failures involving data destruction and breach notification, interference with the data protection officer’s independence, and obstruction of the investigation.
- The breach occurred in late June and was discovered in mid-November; Coupang had warned that 33.7 million accounts were compromised.
- Authorities identified a former Coupang IT employee as the primary suspect. Coupang said it planned compensation payments and purchase vouchers for affected customers.
Article Details
- Event Type
- Customer data breach followed by regulatory penalties.
- Impact
- South Korea’s PIPC fined Coupang 624.6 billion won (about $409 million) after investigators found that personal information belonging to approximately 37.55 million people had been leaked, citing inadequate authentication key management and access controls. Coupang Fulfillment Service was also fined 248 million won for unlawful handling of customer data. Authorities identified a former Coupang IT employee as the primary suspect; Coupang said data retained for approximately 3,000 accounts was deleted and not transferred to others.