Coupang Ordered to Pay Damages in First Ruling Over 34 Million-User Data Breach
A consumer mediation panel set a 100,000 won benchmark for damages after a former employee leaked sensitive user data.
A South Korean consumer dispute mediation panel has ruled that e-commerce giant Coupang must pay 100,000 won (approximately $69) to each of 50 consumers affected by a massive data breach. This decision marks the first time the company's liability for damages has been formally recognized in this specific case.
According to the ruling, the compensation can be issued in either cash or Coupang Cash. The breach was catastrophic in scale, exposing the personal information of approximately 34 million users. The leaked data was highly sensitive, including names, email addresses, home addresses, order histories, and apartment entrance passcodes.
The Cause of the Leak
The security failure was traced back to a former employee who retained system access after leaving the company. This individual extracted user data between April and November of the previous year. Public frustration grew after it was revealed that Coupang did not detect the intrusion proactively; instead, the company only discovered the breach following a customer complaint. In response to these failures, the Personal Information Protection Commission imposed a record-high fine of 624.68 billion won on the company.
Industry Implications
This ruling establishes a critical precedent for liability and compensation benchmarks in South Korean data breach litigation. While the mediation is not legally binding unless both parties accept it, the 100,000 won figure is based on previous court rulings regarding emotional distress caused by the exposure of private information. The Consumer Dispute Settlement Commission stated that Coupang has the responsibility to compensate consumers for the emotional distress caused, noting that customers relied on the platform for various aspects of their daily lives.
What's Next
Industry observers will now watch to see if Coupang accepts the mediation terms or if the case moves toward a larger class-action framework. The outcome will likely influence how other South Korean tech firms handle data security and the scale of payouts for similar breaches in the future. As the first formal recognition of liability in this case, the ruling signals a shift toward stricter accountability for platform operators regarding the safeguarding of sensitive personal identifiers.