In a landmark decision, South Korean authorities have levied a staggering fine of 624 billion won (over $400 million) on Coupang, a leading retail company, following a significant data breach that affected the personal information of more than 34 million customers.
The Personal Information Protection Commission of Seoul announced this maximum penalty after uncovering the breach, which occurred in December 2025. Coupang, often referred to as the "Amazon of Asia" and headquartered in the United States, revealed that the breach allowed a former employee to access sensitive data, including names, email and shipping addresses, phone numbers, and order histories of nearly two-thirds of South Korea's population.
Coupang has stated its intention to contest the regulator's ruling. This case marks a rare instance of a financial penalty imposed on a U.S.-based corporation in South Korea. Some Korean lawmakers have expressed concerns, suggesting that American officials may be exerting political pressure in response to the incident, particularly regarding the implications for U.S.-South Korean relations.
Typically, U.S. companies are less likely to face financial penalties or criminal charges for data breaches due to the absence of stringent laws and enforcement mechanisms. However, this situation highlights a growing emphasis on data protection and accountability in the digital age.
The implications of this fine extend beyond Coupang, potentially influencing how companies manage consumer data and respond to breaches in the future. As global awareness of data privacy increases, this landmark decision could pave the way for stricter regulations and enhanced protections for consumers worldwide.