Coupang Files Lawsuits Against $462 Million Data Breach Fines

South Korean e-commerce company Coupang has taken legal action against fines totaling approximately $462 million imposed over the exposure of millions of users' personal information and unauthorized data collection activities. The company filed two separate lawsuits with the Seoul Administrative Court seeking to overturn penalties totaling 624.7 billion won imposed by South Korea's Personal Information Protection Commission (PIPC).

Coupang Faces Record Fines for Two Separate Violations

The lawsuits, filed on October 7, 2026, concern two separate fines decided in June. The regulatory authority imposed a fine of 423.6 billion won for violating security obligations related to personal data protection and another fine of 201.1 billion won for tracking users' online activities without authorization. The combined penalties marked the highest fines ever imposed on a single company by South Korea's personal data protection authority. The company also requested a suspension of the enforcement of the penalties.

Data of 37.5 Million People Affected

The data breach reported in November 2025 was found to have affected approximately 37.5 million people. Of these, 33.2 million were platform members, while 4.3 million were other individuals. The exposed information included names, phone numbers, email addresses, and delivery details. The regulatory authority reported that the incident resulted from inadequate access controls and deficiencies in basic security measures rather than a sophisticated cyberattack.

The investigation found that a former employee had gained unauthorized access, that the company had failed to adequately assess suspicious activities, and that it had not fulfilled its data breach notification obligations within the required timeframe.

Unauthorized Data Collection Detected in E-Commerce Advertising

The investigation was not limited to the data breach. Authorities determined that, as part of Coupang's digital advertising activities, behavioral data from approximately 11.17 million users across different websites and applications had been collected without a legal basis.

The collected information included visited website addresses, access times, IP addresses, and device identifiers. The regulatory authority stated that the necessary user consent had not been obtained for the use of this data in targeted advertising.

Customer data used in e-commerce, AI-powered personalization, and digital retail applications also falls within the scope of personal data protection regulations. However, the investigation was not based on a separate finding of a violation related to the company's use of artificial intelligence.

Coupang Seeks to Overturn the Fines

In a statement to Reuters, the company confirmed that it had filed two separate administrative lawsuits. The company argued that the penalties were disproportionate, and it was also reported that protective measures had been implemented following the discovery of the breach.

Under South Korean law, companies can be fined up to 3% of their annual revenue generated from relevant activities for personal data violations. The penalties imposed on Coupang, which is listed on a U.S. stock exchange, have also become a topic of discussion between the two countries, as some U.S. officials questioned whether the company was being treated fairly in its South Korean operations.