Coupang—South Korea fined Coupang record ₩624.7B ($410M) over data breach exposing 37.5 million users caused by inadequate security
South Korea's Personal Information Protection Commission (PIPC) fined Coupang a record 624.7 billion won (~$410M) after finding a former employee's compromised authentication keys allowed unauthorized access to internal systems from April to November 2025, exposing names, addresses, phone numbers, order history, and building access passwords for 37.5 million users (33.2M members and 4.3M non-members). PIPC attributed the breach to inadequate baseline data-protection management rather than sophisticated hacking, and separately found Coupang had been unlawfully tracking the online activity of 11.2 million users. Subsidiary Coupang Fulfillment Services was separately fined 248 million won.
Scoring Impact
| Topic | Direction | Relevance | Contribution |
|---|---|---|---|
| Data Security | -against | primary | -1.00 |
| Overall incident score = | -0.885 | ||
Score = avg(topic contributions) × significance (high ×1.5) × confidence (0.59)
Evidence (1 signal)
PIPC plenary decision fines Coupang record ₩624.7B over data breach and unauthorized user tracking
South Korea's Personal Information Protection Commission determined the breach stemmed from inadequate baseline data-protection management after a former employee's compromised authentication tokens were used to access internal systems from April to November 2025, and separately found Coupang unlawfully tracked 11.2 million users' online activity. Subsidiary Coupang Fulfillment Services was fined an additional 248 million won.