South Korea Fines Coupang $400 Million for Data Breach That Exposed 34 Million Customers

The Breach

Coupang is often called the Amazon of Asia. It's headquartered in the United States but does most of its business in South Korea, where it has become the dominant e-commerce platform.

According to TechCrunch, a former Coupang employee obtained the names, email addresses, shipping addresses, phone numbers, and order histories of approximately 34 million customers — a breach that was discovered in December 2025 and affected roughly two-thirds of South Korea's total population.

The Fine

On June 11, 2026, Seoul's Personal Information Protection Commission imposed the maximum allowable penalty: 624 billion won, which converts to over $400 million USD, according to TechCrunch.

This is a record-breaking fine by South Korean standards and represents one of the largest data privacy penalties ever issued against a U.S.-headquartered firm by a foreign regulator.

Coupang told BBC News it plans to challenge the decision. Challenges to regulatory fines are standard legal procedure, and courts may well reduce or overturn the penalty. No independent adjudication has yet occurred.

Political Pressure Allegations

TechCrunch reported that Korean lawmakers have accused some U.S. representatives of applying political pressure — specifically, linking the Coupang case to U.S.-South Korean bilateral relations. American officials reportedly suggested that Seoul's pursuit of a U.S. company might complicate the broader diplomatic relationship.

No specific U.S. lawmakers have been named in the available sourcing, and the reports of political pressure remain attributed to Korean lawmakers' accusations rather than confirmed conduct. The accusation raises a question: should trade diplomacy be used to shield American corporations from foreign privacy regulators doing their jobs?

If Coupang violated South Korean law and exposed 34 million people's personal data, diplomatic intervention is not the appropriate response.

The Enforcement Gap in the U.S.

This fine would almost certainly not have happened if the breach had been a domestic U.S. matter.

As TechCrunch noted, "U.S. companies rarely face financial sanctions or criminal prosecution for data breaches as a result of lacking laws and enforcement powers."

The U.S. has no equivalent to South Korea's Personal Information Protection Commission with the authority to impose nine-figure fines. Republicans and Democrats alike have spent decades failing to pass comprehensive federal data privacy legislation.

Americans hand their data to retailers, apps, and platforms every day with essentially zero guarantee that a breach will result in meaningful consequences for the company responsible. South Korea just demonstrated what accountability looks like.

The Case for Scrutiny

Coupang's defenders make a legitimate point: a 624 billion won fine — capped at the legal maximum — is an extraordinary punishment, and maximum-penalty enforcement against a single company requires scrutiny. Was Coupang's negligence egregious enough to warrant the ceiling, or is this a case where a foreign regulator is setting an example on a U.S. firm for other reasons?

Regulatory overreach is possible, and maximum fines can sometimes reflect political theater more than proportionate justice. Coupang's decision to challenge the ruling in court is entirely reasonable — that's how rule-of-law systems function.

But the scale of the breach is not in dispute. 34 million people. Names, phone numbers, addresses, purchase histories. A former employee with access left with the data. Whatever the final penalty after legal challenge, something serious went wrong inside Coupang's data security architecture.

The Larger Picture

South Korea fined a company the equivalent of over $400 million for losing control of its customers' data. The U.S. has no comparable mechanism to do the same.

Until Congress passes federal data privacy law with real financial consequences, American consumers remain commercially valuable but legally unprotected.