South Korea's Personal Information Protection Commission has fined e-commerce giant Coupang a record 624.7 billion won (approximately $409 million) for a 2025 data breach that exposed the personal information of over 33 million users. This is the largest penalty ever imposed in the country for a data privacy violation. The fine consists of 423.58 billion won for the data leak itself and another 201.16 billion won for unauthorized collection of user online activities.
The breach, initially reported in November 2025, was attributed to a former employee who hacked into the company's systems. The incident has since escalated, drawing scrutiny from U.S. lawmakers and becoming a point of diplomatic friction between the U.S. and South Korea, with some American officials alleging discriminatory targeting of a U.S.-listed firm. The penalty is roughly equivalent to Coupang's entire operating profit from the previous year.