South Korea Imposes Over $400 Million Penalty on Coupang Following Massive Data Breach

South Korean authorities have imposed a record fine of 624 billion won, or more than $400 million, on e-commerce giant Coupang following a data breach that exposed the personal information of more than 34 million customers.

The Personal Information Protection Commission announced the penalty on Thursday after investigating a breach discovered in December 2025. Coupang, a U.S.-headquartered retailer often referred to as the “Amazon of Asia,” previously said the months-long incident allowed a former employee to access sensitive customer data.

According to the company, the compromised information included names, email addresses, shipping addresses, phone numbers, and order histories. The breach affected roughly two-thirds of South Korea’s population, making it one of the country’s largest data security incidents.

Coupang told BBC News that it plans to challenge the regulator’s decision. The case has drawn significant attention because large financial penalties imposed by foreign regulators on U.S.-based companies remain relatively uncommon.

The investigation has also sparked political discussion. South Korean lawmakers have alleged that some U.S. representatives attempted to link the case against Coupang executives to broader U.S.-South Korea relations, adding another layer of controversy to the proceedings.

The penalty stands out at a time when U.S. companies rarely face major financial sanctions or criminal prosecution for data breaches, often due to differences in legal frameworks and enforcement powers. As a result, the record fine against Coupang is expected to be closely watched by regulators and technology companies worldwide.