South Korea's largest e-commerce platform, Coupang, has been issued a record-breaking data protection fine by the country's regulator, amounting to 624.6 billion won (approximately $409 million), further straining the company's already pressured financial position.

The fine was announced on Thursday by South Korea's Personal Information Protection Commission. The data breach impacted nearly two-thirds of the nation's population, exposing serious lapses in Coupang's cybersecurity controls. Commission Chairperson Song Kyung-hee stated the company "failed to take sufficient measures to detect and respond to unauthorized external access."

This penalty is the highest ever imposed in South Korea for a single corporate data breach case. Coupang had already reported a $242 million operating loss in the first quarter of this year and forecast a slowdown in its full-year revenue growth. This fine intensifies the performance pressures on the company, often referred to as the "Amazon of South Korea."

Dual Lines of Accountability: Breach and Violation

The Personal Information Protection Commission detailed that the 624.6 billion won fine comprises two parts: 423.6 billion won for the data breach incident itself, and the remaining 201 billion won for the collection and use of personal information without user consent.

Investigations revealed the data leak occurred in April of last year via Coupang's overseas servers, but the company did not detect it until November. A former employee accessed customer information using a private encryption key that remained active. Following the incident's disclosure, the CEO of Coupang's Korean subsidiary resigned, and President Lee Jae-myung characterized the case as a cautionary example for strengthening cybersecurity.

Under South Korean law, companies failing to implement adequate data protection measures can be fined up to 3% of their previous year's revenue. If a data breach results from intentional misconduct or gross negligence, authorities can impose punitive damages of up to five times the actual harm. Some lawmakers had previously called for a fine against Coupang as high as 1.2 trillion won. The company's sales in 2025 were 49 trillion won.

Erosion of User Trust Amid Financial Strain

Coupang expressed "regret" over the ruling, stating that the corrective measures and explanations it provided after the data breach "were not fully reflected in the Commission's decision," and indicated it would seek factual clarification through legal proceedings.

The fine comes as Coupang faces a crisis of user trust triggered by the security incident. The company recorded a $242 million operating loss in Q1 this year and warned that security concerns have led some consumers to reduce their use of its platform, which will pressure its full-year revenue growth.

Coupang was founded in 2010 by Korean-American Harvard graduate Bom Kim. It grew into South Korea's top e-commerce platform, powered by its overnight "Rocket Delivery" service. Backed by Japan's SoftBank, the company boasts 25 million active members, with operations spanning food delivery and streaming services. It is South Korea's second-largest private employer, after Samsung.