South Korea’s Personal Information Protection Commission (PIPC) imposes a record fine of 624.68 billion won (about $409 million) on e-commerce company Coupang over a major data breach. The penalty is the largest privacy-related sanction in the country and includes 423.6 billion won tied to the breach and an additional 201.1 billion won for related privacy violations, including unauthorized collection of users’ online activity records. The PIPC says the breach involved more than 33 million users, with later findings putting the figure around 37.5 million after a joint government-civilian investigation led by the Ministry of Science and ICT identified additional affected accounts.
Authorities report that the responsible party obtained access by exploiting weak security controls, including lax management of an authentication signing key and insufficient access controls that allowed a former employee to forge tokens and reach pages containing personal data. Several outlets note the fine is far larger than the penalty previously imposed on SK Telecom for last year’s incident. Coupang disputes the outcome, pledging legal action. Meanwhile, the magnitude of the fine triggers debate over whether regulatory penalties are proportionate and raises questions about the company’s future investment plans.