Coupang Hit With Record $409 Million Fine After Massive Data Breach
South Korean regulators levy the country's largest-ever data breach penalty after a former employee accessed millions of customer accounts.
Coupang Inc. is facing a severe financial and regulatory crisis after a massive data breach exposed the personal information of approximately 33.7 million customers. The incident has triggered a record-breaking fine and sparked a diplomatic dispute between U.S. investors and the South Korean government.
South Korea's Personal Information Protection Commission (PIPC) fined Coupang Corp. 624.7 billion won, or approximately $409 million. This represents the largest fine ever imposed in South Korea for a data breach. The scale of the exposure was immense, affecting roughly 33.7 million accounts—a figure that encompasses a vast portion of the South Korean population. According to the PIPC, the breach occurred around November 2025 and was not the result of a sophisticated external attack. Instead, the vulnerability was exploited by a former employee who had retained valid authentication keys to access customer data repositories.
Management Failures
The regulatory crackdown focused on the company's internal security protocols rather than technical hacking. Kyung Hee Song, Chairperson of the PIPC, stated that the incident was caused by "Coupang’s inadequate basic safety management system and negligent management," rather than a complex hacking method. This finding suggests a systemic failure in how the e-commerce giant managed access credentials for departing staff.
Financial and Diplomatic Fallout
The breach has had a direct impact on Coupang's bottom line. The company reported growing losses in early 2026, driven in part by the issuance of customer vouchers provided as compensation to affected users. This move to appease customers contributed to a decline in revenue growth and fueled significant stock price volatility, including a 19% drop in December 2025.
Beyond the balance sheet, the incident has escalated into a geopolitical issue. Major U.S. investors, including Altimeter Capital and Greenoaks Capital Partners LLC, have alleged that the South Korean government treated Coupang in a discriminatory manner. These investors have petitioned the Office of the United States Trade Representative (USTR), highlighting the friction that arises when a U.S.-listed company operates under the strict regulatory jurisdiction of a foreign government.
The Path Forward
Coupang now faces the challenge of rebuilding trust with its massive user base while navigating an adversarial relationship with South Korean regulators. Market observers will be watching for whether the company implements more rigorous identity and access management (IAM) protocols to prevent similar internal leaks. Additionally, the outcome of the USTR petition may determine if the dispute remains a corporate matter or evolves into a broader trade tension between Washington and Seoul.