Coupang Data Breach, Now It Is the Personal Information Protection Commission's Turn... Focus on Breach Scale and Penalty Surcharge

33.67 Million Items of Coupang User Data Leaked, Delivery Information Viewed 1.48 Billion Times
Actual Scale of Personal Data Breach to Be Determined by Personal Information Protection Commission Investigation
Current Law Allows Penalty Surcharge of Up to 3% of Total Sales

As the joint public-private investigation team that has been probing Coupang's massive personal data breach has uncovered that 33.67 million items of personal data were leaked and that delivery address and order lists were viewed more than 1.48 billion times, attention is now focused on the upcoming announcement by the Personal Information Protection Commission, which will finalize the actual scale of damage that will be central to the penalty surcharge decision.

After receiving a report on the Coupang data breach in November last year, the Personal Information Protection Commission formed a dedicated investigation task force led by the Director General of the Investigation and Mediation Bureau and has been conducting an investigation. It plans to announce the results as soon as the investigation is completed. On the 11th, an official from the Personal Information Protection Commission said, "It is difficult to determine when it will be completed, but we will announce the results when the investigation and sanctions are finalized."

The key point of the Personal Information Protection Commission's announcement will be the precise scale of damage from this data breach. The Ministry of Science and ICT held a briefing at the Government Complex Seoul the previous day and announced the findings of the joint investigation team: 33.67 million items of personal data, including Coupang users' names and email addresses, were leaked, and during this process the attacker (a former Coupang employee) viewed the delivery address information page more than 1.48 billion times.

The leakage volume disclosed by the joint investigation team is a figure calculated based on the attacker's Coupang web access logs, and does not represent the exact number of personal data items that were actually leaked. It also does not reflect the more than 160,000 additional leak reports that Coupang released on the 5th. On top of this, the number of personal data leaks that occurred in the course of the attacker viewing the delivery address list page more than 1.48 billion times must also be identified. In particular, the attacker also accessed the "Edit Delivery Address List" page, which contained unencrypted shared entrance door passwords, 50,474 times.

Choi Woohyuk, policy chief of the Information Security Network Policy Bureau at the Ministry of Science and ICT, stated, "Under the guidelines of the Personal Information Protection Act, if an attacker has viewed information, that constitutes a data breach." Considering that many Coupang users save not only their own delivery information but also the delivery information of family members or acquaintances in their delivery address data, the scale of the data breach could be even larger. However, because the attacker may have repeatedly opened the delivery address information page for the same user, it is difficult to definitively equate the more than 1.48 billion views with more than 1.48 billion instances of data being leaked.

Coupang Inc., Coupang's parent company, issued a statement refuting the joint investigation team's findings, expressing concern that the number of page views could be misinterpreted as the volume of data leaked, and argued that "the joint investigation team wrote that the attacker viewed common entrance access codes around 50,000 times, but omitted the verified finding that these views were in fact limited to access involving 2,609 accounts."

In addition, the Personal Information Protection Commission is examining a wide range of issues that may constitute violations of the Personal Information Protection Act, including whether Coupang used or provided closed-circuit television (CCTV) footage for purposes other than its original purpose, and so-called "kidnapping ads," known as "forced-redirect advertisements."

Once the actual scale of damage is confirmed, the process will move on to calculating the penalty surcharge. Given that the scale of Coupang's data breach exceeds that of the earlier SK Telecom USIM (Universal Subscriber Identity Module) information leak, there are expectations in the industry that the largest penalty surcharge in history could be imposed. Even if limited to account information among the data leaked in this incident, more than 33 million accounts were compromised, which is greater than the approximately 23.24 million victims in the SK Telecom breach. SK Telecom was fined 134.79 billion won by the Personal Information Protection Commission last year and has filed an administrative lawsuit challenging the decision.

Under the current Personal Information Protection Act, a penalty surcharge of up to 3% of total sales can be imposed. Based on this and a simple calculation using Coupang's sales over the past three years, a surcharge in the 900 billion won range would be possible. However, because the law requires that the surcharge be calculated on sales excluding revenue unrelated to the violation, and in light of the Personal Information Protection Commission's investigation findings, the actual size of the penalty surcharge will likely be determined accordingly.

This content was produced with the assistance of AI translation services.