Coupang

South Korea's Personal Information Protection Commission (PIPC) fined Coupang a record 624.7 billion won (~$410M) after finding a former employee's compromised authentication keys allowed unauthorized access to internal systems from April to November 2025, exposing names, addresses, phone numbers, order history, and building access passwords for 37.5 million users (33.2M members and 4.3M non-members). PIPC attributed the breach to inadequate baseline data-protection management rather than sophisticated hacking, and separately found Coupang had been unlawfully tracking the online activity of 11.2 million users. Subsidiary Coupang Fulfillment Services was separately fined 248 million won.

South Korea's Ministry of Employment and Labor launched an inspection into Coupang after courier Oh Seung-yong died having worked weeks averaging 83.4 hours; a fact-finding investigation by the Korean Delivery Workers' Union found couriers used colleagues' IDs to conceal shifts that exceeded legal consecutive-day work limits, and Oh's family alleged the company pressured them to avoid classifying his death as an industrial accident. South Korea does not legally cap overnight working hours. At least 46 Coupang-linked worker deaths have been recorded since 2020.