Coupang faces record fine as privacy regulator prepares sanctions over data breach

The Personal Information Protection Commission convened a plenary session Wednesday at the Government Seoul Complex to deliberate on sanctions against Coupang Inc. over a data breach that exposed roughly 33 million personal records — about seven months after the leak became public in November last year.

A joint public-private investigation team under the Ministry of Science and ICT released its findings in February, confirming that 33.67 million records — including users' names and email addresses — had been leaked through a vulnerability in Coupang's "edit my information" page.

The commission sent Coupang a pre-notification letter in April detailing alleged violations of the Personal Information Protection Act and the planned sanctions. Coupang requested an extension to submit its response and subsequently filed its position, largely disputing the commission's findings, according to sources familiar with the matter.

Given the scale of the breach, analysts expect the fine to be the largest ever imposed under the law. The Personal Information Protection Act allows the commission to levy a fine of up to 3 percent of a company's sales related to the violation, excluding revenue unrelated to the breach.

Coupang reported sales of 45.5 trillion won last year in filings with DART, which would put the statutory maximum fine at roughly 1.3637 trillion won if applied in full. The actual penalty, however, will be determined after factoring in the scope of sales tied to the violation and any mitigating or aggravating circumstances.

To date, the largest fine the Personal Information Protection Commission has ever imposed was the 134.8 billion won penalty handed down last year over SK Telecom's SIM card data breach.

The National Assembly earlier passed an amendment to the Personal Information Protection Act introducing a "punitive fine" provision that would allow penalties of up to 10 percent of sales when a large-scale data breach results from willful misconduct or gross negligence. The amendment takes effect in September and will not apply to this case.