South Korea fined Coupang, the country’s largest online retailer, a record 624.7 billion won, about $409 million, on Thursday, holding it accountable for a massive breach of customer data and accusing it of illegally collecting personal information.
The penalty, imposed by the government’s Personal Information Protection Commission on Coupang — often called the “Amazon of South Korea” — marked the largest data-privacy fine in the country’s history. Coupang, which is incorporated in the United States but generates most of its revenue in South Korea, said it would challenge the ruling in court.
The regulatory probe has grown into a rare diplomatic dispute between Washington and Seoul. Coupang and some Republican members of Congress have accused the South Korean government of weaponizing regulatory proceedings against an American company.
South Korean officials have defended their actions as “due process,” describing the American intervention as interference in South Korea’s domestic affairs. They say Coupang’s lobbying in Washington has been so intense that it has gummed up talks between South Korea and the United States over a trade deal, the loss of which could lead to punitive American tariffs.
On Thursday, the commission said the breach, discovered last year, exposed personal information from 33 million customer accounts and an additional 4 million nonmembers, including relatives of Coupang users. It also said that the company had unlawfully collected and stored the online activity of 11 million users across third-party websites and apps.
“This accident occurred because of Coupang’s lack of safety measures and systems, not sophisticated hacking,” Song Kyung-hee, the chairwoman of the privacy regulator, said on Thursday, referring to the data leak.
Korean American entrepreneur Bom Kim founded Coupang in South Korea, his birth country, in 2010. The company’s “Rocket Delivery” trucks have since become a fixture of urban life across the country. But its relations with the government soured after revelations last November that a former employee in China had gained access to massive amounts of customer data. Mr. Kim further angered lawmakers by refusing to attend a parliamentary hearing.
The fine dwarfs the previous record of $88 million, imposed last year on mobile carrier SK Telecom for its own data breach.
Coupang reiterated an apology on Thursday, pledging to strengthen its data protection practices. However, it expressed regret that the pre-emptive steps it had taken to prevent secondary harm, as well as its own personal data protection practices, had not been adequately reflected in the commission’s decision.
“After receiving the commission’s official ruling, we expect the facts to be clearly established through legal procedures,” Coupang said in a statement.
