Record Fine After 13-Hour 'Marathon' Review... Song Kyunghee: "Coupang to Be Reported for Obstructing Investigation" (Comprehensive)

Coupang and its affiliate CFS fined a total of 624.9 billion won
More than four times the previous record fine imposed on SK Telecom
4.24 billion won fine for personal information leak
2.01 billion won fine for unauthorized collection of us

Last November, Coupang and its logistics subsidiary Coupang Fulfillment Services (CFS), which were responsible for a large-scale personal information leakage incident, were fined a record amount of 624.9 billion won. The Personal Information Protection Commission announced plans to file a complaint against Coupang for obstructing the investigation, such as deleting logs, while Coupang stated its intention to take legal action, including administrative litigation.

On the 11th, the Personal Information Protection Commission held a plenary session the previous day and, after more than 12 hours of deliberation on the sanctions against Coupang, decided to impose a fine of 624.681 billion won for violating the duty to implement security measures and collecting personal information without a legal basis. An additional administrative fine of 16.8 million won was set. CFS was fined 248 million won for violations related to personal information processing.

Song Kyunghee, Chairperson of the Personal Information Protection Commission, is briefing on the decision regarding sanctions for the Coupang incident at the Government Complex Seoul in Jongno-gu, Seoul on the 11th. Photo by Yonhap News

According to the current Personal Information Protection Act, the maximum fine for a personal information leakage incident is up to 3% of the average revenue over the previous three years (2022–2024). According to the Commission, Coupang’s average revenue over this period was approximately 36 trillion won, meaning that the maximum possible fine calculated on this basis could have been as much as 1.08 trillion won. This is more than four times the previous record fine imposed on SK Telecom (134.8 billion won) in August last year.

"Coupang incident caused by managerial negligence, not sophisticated hacking"

Over 30 million cases of large-scale personal information leakage have occurred at Coupang. This exceeds the economically active population of 29.69 million, making it the worst leakage incident in history. Photo by Dongju Yoon, taken at Coupang headquarters on December 1, 2025.

Song Kyunghee, Chairperson of the Personal Information Protection Commission, emphasized during a briefing at the Government Complex Seoul on this day, "We have confirmed that this data breach was not the result of sophisticated hacking, but rather due to deficiencies in basic safety management systems and managerial negligence." The Commission concluded that the number of affected individuals was about 37.5 million. It was found that personal information of approximately 33.22 million members, based on account data, and of at least 4.33 million non-members, based on mobile phone numbers (including information subjects listed on delivery address management pages), was leaked.

According to the Commission, Coupang was negligent in access rights management, operating a key management system that allowed plaintext viewing of alternative authentication signing keys when such access was not required for work. Even after a hacker with access to these keys left the company in December 2024, Coupang did not immediately update or discard the signing keys. Furthermore, despite excessive abnormal traffic and multiple unauthorized accesses, the company failed to detect these anomalies until it received customer complaints following a blackmail email from the hacker.

Additional violations were identified, including failure to notify and destroy leaked information, breach of the independence of the Chief Privacy Officer (CPO), and obstruction of the investigation. Coupang conducted its own investigation into the hacker and excluded the CPO from the process of publishing the results on its website. The Commission imposed a fine of 423.575 billion won on Coupang for causing the large-scale personal information breach and an administrative fine of 16.8 million won for violating notification and destruction obligations.

In addition, the Commission found that Coupang used its 'Coupang Partners' program, operated since 2018, to collect and store online activity records of approximately 11.17 million members in its database without consent. The data collected without authorization included user visit records (such as URLs and app names) to third-party websites and apps, access dates and times, and IP addresses. A separate fine of 201.1 billion won was imposed for this violation.

Furthermore, CFS was found to have collected the names of 71 reporters from the National Police Agency press corps who had no record of working at logistics centers from September 2023 to February 2024, and registered them on an employment restriction list. CFS also submitted employees' weight information, which was held and managed for health management purposes, during industrial accident litigation, thereby violating sensitive data processing standards. The Commission imposed fines of 220 million won and 28 million won for each of these violations, respectively.

The Commission plans to file a complaint against Coupang for obstructing the investigation during the process. Chairperson Song stated, "There were actions that actually made the investigation difficult, such as deleting access log records," and added, "If the requirements under the relevant law are met, we will proceed with filing the complaint."

The Commission explained the difference from the results announced by the joint public-private investigation team of the Ministry of Science and ICT in February (which found 33,673,817 cases of personal information leakage) by saying, "The joint investigation team calculated the number based on the number of views of the 'member information edit page' according to access records. The Commission, on the other hand, excluded cases where the attacker made duplicate views or where personal information was no longer in the database due to account withdrawal, and instead added a minimum estimate of non-member information subjects."

Personal Information Protection Commission: "No consideration of diplomatic issues in fine calculation"... Coupang: "Legal action to follow"

Delivery trucks waiting at a Coupang logistics center in Seoul. Photo by Yonhap News Agency

The Commission stated that it did not take into account any diplomatic or trade issues with the United States when calculating the fine. Chairperson Song said, "We made this decision based on facts, evidence, and investigation results," and added, "We did not consider Coupang’s nationality or any other external influence."

According to industry sources, Coupang's U.S. parent company, Coupang Inc., spent 1.09 million dollars (about 1.6 billion won) on lobbying the White House, administration, and Congress in the United States by March of this year. Due to this, during the period when Coupang was under investigation by the police and the Commission, there were claims in a U.S. House hearing that the Korean government was discriminating against American companies.

Meanwhile, Coupang has stated its intention to file an administrative lawsuit challenging the Commission's fine. In a statement released on the same day, Coupang said, "Proactive measures to prevent secondary damage and explanations based on clear facts were not sufficiently reflected in the decision," and added, "We hope that the facts will be clarified through legal procedures after we receive the official written decision."

This content was produced with the assistance of AI translation services.