South Korea hits Coupang with record $409 million privacy fine

South Korea’s privacy watchdog hit Coupang with a record 624.7 billion won, about $409 million, penalty after a breach exposed personal data on a staggering scale. The Personal Information Protection Commission said the sanctions covered both the leak of customer information and the unauthorized collection of online activity records, turning the case into a test of whether the biggest fines can force real changes at a national tech giant.

The commission said the case involved more than 33 million customers in one account tied to the leak, while other reporting put the total number of affected users at about 37.5 million. Regulators said Coupang failed to detect the breach within the 72-hour reporting window required by law and that basic safeguards were inadequate, findings that pushed the case beyond a single security lapse and into questions about the company’s data governance.

The penalty is the largest privacy fine ever imposed in South Korea and dwarfs the previous record of 134.791 billion won levied on SK Telecom in August 2025. The new fine was split into 423.6 billion won for the data breach and 201.1 billion won for unauthorized collection of records on user activity, showing how regulators treated the company’s conduct as a combination of breach response failures and broader compliance violations.

The financial hit is severe even by Coupang’s standards. The fine amounts to about 1.4% of Coupang’s 2025 revenue of 45 trillion won, and Korean outlets said it is roughly equivalent to the company’s 2025 operating profit of 721.1 billion won. That comparison raises the stakes for a company that dominates South Korea’s e-commerce market and has become a national-scale platform with deep reach into daily life.

Coupang said it regretted the incident and would strengthen its personal-data protection framework, while also signaling that it may contest the ruling through legal procedures. The company said, “We fully recognize our grave responsibility,” as pressure mounted from U.S. lawmakers, who have scrutinized the case because Coupang is incorporated in the United States. After months of investigation, the penalty now stands as a benchmark for how hard South Korea is willing to hit tech firms when millions of users are left exposed.