SOUTH KOREA FINES COUPANG $400M OVER 37.5 MILLION DATA BREACH

South Korea's Personal Information Protection Commission (PIPC) has fined e-commerce company Coupang 624.68 billion won, equivalent to more than $400 million (£299 million), over a data breach affecting approximately 37.5 million users. The PIPC announced the penalty on Wednesday, citing violations of safety obligations and the collection of personal data without legal grounds. Investigators found that poor management of authentication signing keys and inadequate access controls allowed customer data to be exposed. The breach affected names, contact details, delivery information and order histories belonging to customers of Coupang, South Korea's largest e-commerce platform.

The fine is the largest ever issued by the PIPC for a data breach in South Korea. Coupang initially reported a breach involving 4,500 customer accounts to authorities in November, but subsequent checks identified approximately 34 million affected accounts. The commission's investigation determined the breach is believed to have begun as early as June, originating via a server based abroad. The number of exposed accounts represents more than half of South Korea's population of around 50 million. Following the incident, Coupang chief executive Park Dae-jun resigned from his role and apologised.

Coupang, which is headquartered in the United States but generates the majority of its revenue from South Korea, said it deeply regrets the concern caused. The company stated that its explanations and preventive measures were not sufficiently reflected in the PIPC's decision. Coupang confirmed it intends to challenge the ruling through legal procedures once it receives the official resolution. The company added that it will strengthen its security measures in response to the breach.