South Korea hits Coupang with record fine over e-commerce data leak

SEOUL: South Korea hit e-commerce giant Coupang with a record US$408 million fine on Thursday (Jun 11) over a leak that allegedly exposed more than 30 million customers’ data and has provoked the ire of US lawmakers.

Coupang, the country’s largest online retail platform, signalled in a statement that it would challenge the fine in court.

The government’s move caps a months-long probe into Coupang, which is incorporated in the United States.

Allegations of a massive data leak first surfaced in November and have become an unexpected source of friction between Seoul and Washington.

Seoul’s Personal Information Protection Commission said it would “impose a total of 624.68 billion won in fines … on Coupang for violating safety obligations and collecting personal data without legal grounds”.

It is by far the largest ever penalty for a data leak in South Korea – far exceeding the previous record of a US$88 million fine imposed last year on mobile carrier SK Telecom.

“Inadequate basic safeguards, including poor management of authentication signing keys and lax access controls” caused the personal data of around 37.5 million users to be exposed, the commission said in a statement.

Coupang has maintained that only 3,000 customer records were involved.

Commission chair Song Kyung-hee told a press briefing Thursday that the retail giant should have notified affected individuals within 72 hours.

But Coupang “delayed breach notifications”, she said. “As a result, those individuals were unaware of the breach and deprived of the opportunity to take steps to prevent secondary harm.”

Coupang on Thursday apologised for causing concern to customers and the public, vowing to strengthen its data protection framework.

“However, we regret that proactive measures taken to prevent secondary damage and explanations based on clear facts regarding last year’s data breach were not sufficiently reflected” in the commission’s decision, it said.

“After receiving the commission’s official ruling, we expect the facts to be clearly established through legal procedures,” Coupang added.