South Korea rejects U.S. report in Coupang breach dispute

South Korea pushed back hard on Coupang’s claim that only about 3,000 records were affected, saying authorities had identified access to more than 33 million records and that the breach was far more serious than the company has suggested. National Security Adviser Wi Sung-lac said South Korea rejected the idea that Coupang had been unfairly targeted, sharpening a dispute that now reaches well beyond one e-commerce platform.

The scale of the breach has already triggered one of South Korea’s biggest privacy penalties. In June 2026, the Personal Information Protection Commission fined Coupang 624.681 billion won, about $409 million, after concluding that personal information for 37.55 million customers was exposed and that online activity data from 11.17 million users had been unlawfully collected. The commission’s findings made the case the country’s largest privacy fine against a company, and Coupang has said it will challenge the penalty in Seoul Administrative Court.

The conflict escalated again when the U.S. House Judiciary Committee issued an interim report on July 2, 2026, accusing South Korea of discriminatory treatment of Coupang after the breach. The committee said South Korean authorities had escalated numerous investigations and argued that the government’s actions may violate a bilateral trade agreement signed in 2025. South Korea’s foreign ministry had already called the U.S. report one-sided, and Wi said Seoul would keep explaining its position to U.S. counterparts while trying to prevent the matter from spilling into broader negotiations with Washington.

At the center of the case is not only the size of the exposure but also the question of where the access began. Reporting has linked the breach to a former employee in China who allegedly used retained company credentials to reach customer records. That detail matters because it shapes both the legal risk and the public debate over whether Coupang’s internal controls failed or whether regulators have pushed too far.

Coupang is one of South Korea’s best-known e-commerce firms, so the fight over 3,000 records versus more than 33 million has become a test of public trust in digital security, corporate accountability and the government’s willingness to enforce privacy law even as Seoul tries to protect trade and alliance ties with Washington.