Coupang faces record $400M fine in South Korea over data breach

South Korean authorities have imposed a record-breaking financial penalty on Coupang, the retail giant headquartered in the U.S. but popular in South Korea. The country’s data regulator, the Personal Information Protection Commission, issued the penalty of $624 billion won (over $400 million) on Thursday. The Personal Information Protection Commission is the South Korean regulatory body responsible for data protection. The penalty represents a record-breaking fine for a data breach in South Korea. The decision follows the discovery of a data breach in December 2025 that compromised the personal information of more than 34 million customers. Coupang had previously stated that the security incident allowed a former employee to obtain the personal data of about two-thirds of South Korea’s population. This compromised information included names, email addresses, shipping addresses, phone numbers, and order histories of the affected users.

In response to the regulator’s decision, Coupang told BBC News that it plans to challenge the financial penalty. The company, which is headquartered in the U.S. but popular in South Korea and often likened to the “Amazon of Asia,” faces a potential legal battle with South Korean authorities. The dispute has already drawn political attention; South Korean lawmakers have accused some of their American counterparts of imposing political pressure. These accusations followed reports that U.S. representatives were linking the data breach case with U.S.-South Korean bilateral ties, specifically in response to the legal proceedings against Coupang’s executives.

The scale of the fine highlights the growing regulatory friction between U.S. tech firms and foreign data protection authorities. Historically, U.S. companies rarely face financial sanctions or criminal prosecution for data breaches in their home market, a result of lacking laws and enforcement powers. Consequently, this case represents a rare instance of a financial penalty issued against a U.S.-based firm, underscoring the growing tension between American tech companies and foreign data protection regulators.

Why it matters

This case represents a rare instance of a financial penalty issued against a U.S.-based firm, highlighting the growing tension between American tech companies and foreign data protection regulators.