Consumer Dispute Mediation Committee: "Coupang Must Compensate Data Breach Victims 100,000 Won Each"

Coupang Held Liable for Damages for the First Time
Coupang Must State Its Acceptance of the Mediation Proposal Within 15 Days
Full Compensation for All 37.56 Million Leaked Accounts Would Be a Heavy Burden

The Consumer Dispute Mediation Committee has ruled that Coupang must compensate victims of its personal data breach with 100,000 won per person, either in cash or as Coupang Cash credits. Coupang is required to notify the committee within 15 days of receiving the ruling as to whether it will accept the mediation proposal.

On July 31, the committee announced that it had recognized Coupang’s liability for damages after reviewing the case, which was brought as a collective dispute mediation request by 50 consumers following last year’s data leak incident.

This is the first time Coupang has been officially held liable for damages to victims of a personal data breach, following the Personal Information Protection Commission’s earlier decision to impose administrative sanctions and fines for violations of the Personal Information Protection Act.

Delivery trucks waiting at a Coupang logistics center in Seoul. Photo by Yonhap News

The committee cited several reasons for its decision: not only general personal information such as Coupang members’ names, email addresses, and home addresses, but also sensitive information closely related to privacy—such as shared entrance passwords and order histories—was leaked. The committee also noted that hackers exfiltrated information over an extended period and even contacted some customers directly regarding the breach, thereby demonstrating actual potential for abuse. Although Coupang claimed that there was no possibility of further leaks, the committee determined that it was difficult to make such a definitive conclusion and concluded that Coupang is liable to compensate for the victims’ emotional distress.

The amount of compensation was set at 100,000 won per person. The committee considered that, in large-scale personal data breach cases, courts have typically awarded compensation within the range of 100,000 won per person. The committee also took into account the fact that the information leaked could easily be misused in daily life. Based on feedback from the representatives of the claimants, and to increase the acceptance rate of the mediation agreement, the committee allowed compensation to be paid in Coupang Cash credits as an alternative to cash payouts at the claimant’s option.

Coupang, as the party involved, must inform the committee within 15 days of receipt of the ruling whether it will accept the proposal. If there is no response, acceptance will be assumed by default. Should both parties accept, the resolution is legally equivalent to a court settlement. If Coupang accepts the committee’s mediation, follow-up measures will include submission of a compensation plan to ensure that identical compensation is provided to victims who did not participate in the collective mediation process.

According to a government investigation, a total of approximately 37.56 million cases of personal information (from both members and non-members) were leaked. If all of them were to apply for compensation, the total payout could amount to as much as 3.7 trillion won.

Coupang stated its official position regarding the committee’s decision: “We will carefully review the mediation proposal after receiving it from the Consumer Dispute Mediation Committee.”

This content was produced with the assistance of AI translation services.