Coupang Hit with Record $409 Million Fine Over Data Breach Affecting 37.5 Million Customers

South Korea's Personal Information Protection Commission finalized on Wednesday a record fine of 624.7 billion won — approximately 409 million U.S. dollars — against e-commerce giant Coupang following a breach of personal data belonging to roughly 37.5 million customers. The penalty, approved during a plenary session of the regulator, represents the largest data protection fine ever issued in the country.

The commission's ruling covers the exposure of personal information from tens of millions of Coupang users, whose data was compromised in what regulators characterized as a serious lapse in data stewardship. The scale of the breach — affecting more than a third of South Korea's total population — underscored the severity of the incident.

To put the fine in context, the previous record for a data protection penalty in South Korea was the 134.8 billion won levied against SK Telecom last year, following a separate breach that affected approximately 23.24 million customers. Coupang's fine is more than four times that figure.

Coupang expressed regret over the commission's decision, stating it would await formal receipt of the official written ruling before pursuing legal remedies. The company indicated it intends to contest the finding through official legal procedures and aims to establish a clear account of the facts surrounding the incident.

Public broadcaster KBS framed the ruling primarily as a landmark enforcement action that signals regulators' willingness to impose substantial penalties on large technology companies. Segye Ilbo highlighted Coupang's combative response and its explicit intent to challenge the decision legally, giving more weight to the company's perspective.

Coupang is one of South Korea's largest e-commerce platforms and a prominent player in the country's digital economy. The scale of the user base affected by the breach raised questions about data governance practices among major online retailers and the adequacy of existing security measures to protect consumer information.

The fine will not become enforceable until Coupang receives the official written determination from the commission, at which point the company's legal timeline for filing an appeal will begin. Whether the penalty will be reduced, upheld, or overturned hinges on court proceedings that could take years to resolve.

The case is being closely watched by legal experts and technology companies operating in South Korea, as the outcome may set important precedents for how large-scale data breaches are prosecuted and penalized under the country's data protection framework going forward.