E-commerce company Coupang has filed two lawsuits at the Seoul Administrative Court asking for the penalties of about ₩624.7 billion imposed by South Korea’s Personal Information Protection Commission (PIPC) in June to be cancelled. It has also asked the court to suspend the penalties while the case is heard.
Key points
- The PIPC fined Coupang about ₩423.6 billion for failing its security obligations, reported as the largest fine for a single incident, and about ₩201.1 billion for collecting around 11.17 million members’ activity on other sites and apps without a lawful basis.
- The breach affected about 37.55 million people between April and November 2025, exposing names, email addresses, phone numbers, and addresses.
- The PIPC blamed internal weaknesses rather than a sophisticated attack: poor management of authentication signing keys, weak access controls, and anomalies that went undetected.
- It also found that Coupang deleted about five months of web access logs after receiving an order to preserve evidence.
Whatever the court decides, the case is a useful reminder for any organisation. Manage signing keys and other secrets carefully, watch for unusual activity, never delete logs once you have been told to preserve them, and check you have a lawful basis for any data you collect from third parties. These map to ISO/IEC 27001 controls A.8.24 (use of cryptography), A.8.15 (logging), and A.8.16 (monitoring activities).
Source: Seoul Economic Daily
This update is general information, not legal advice. If you would like help assessing the impact on your information security or privacy programme, contact us.
