ED Coupang's tenuous oversight
A view of a Coupang delivery box in front of the firm's headquarters in Songpa District, Seoul, Monday. Yonhap
Korean Fair Trade Commission can take cue from US case against Amazon
Coupang delivery boxes and bags have become a familiar presence in Korea. With its retail, restaurant delivery and video streaming services, the nation's largest e-commerce giant is ubiquitous. For that reason, the breach of data of Coupang's 33.7 million subscribers has the nation shaken and fearful of possible danger from secondary smishing and phishing scams.
The data breach at Coupang is by far the largest in a series of similar incidents at Korean firms this year. Back in April, SK Telecom created confusion among phone users after revealing it had been the victim of a cyberattack that leaked data for some 27 million users, resulting in a fine of 134 billion won ($97 million). The police and related ministries are still working to fully understand how it happened.
President Lee Jae Myung has called for strong penalties for Coupang. The massive scale of the data breach is turning this from a security issue to a catastrophe, detrimental for all concerned — consumers, the company and the nation. Relevant government ministries must heed the president's call for accountability and stronger punitive action.
The Fair Trade Commission (FTC), which has historically been lenient towards Coupang, should weigh in on this case. It can take a cue from the former U.S. Fair Trade Commissioner Lina Khan during her tenure, when the U.S. FTC and 17 state attorneys filed an antitrust lawsuit against Amazon for maintaining monopoly power. The FTC and Amazon later reached a $2.5 billion settlement. While her work against Big Tech was sometimes questioned, the overall view is that her actions were vital in preventing use of the "manipulative, coercive and deceptive" techniques regarding memberships, including making it difficult to cancel memberships. Coupang has faced similar accusations. The platforms used in the two countries may be different, but both need to build strong systems to protect the personal information of their users. As the digital era evolves, data, including personal, is becoming more like a social asset. Governments, businesses and consumers must learn to treat it likewise.
The names, emails, mailing addresses, phone numbers and order histories of 33.7 million subscribers were compromised, but not their payment details or login credentials. Subscribers are doing what they can, including changing passwords. There is a potential class-action suit against the company.
The data breach mandates a critical debate about platforms setting up data protection systems and investing in their management in a way that takes into account their astounding size and importance to consumers.
Once a platform grows to the massive size of an Amazon or Coupang, there has been a tendency to reduce cybersecurity investments. Business sentiment is that it's more cost-effective to just pay any fines. The latest data leak should serve as a grave wake-up call.
In Coupang's case, the suspect in the data breach is a former employee who still had access to their authentication key even after their contract with the firm was terminated. It is abundantly clear that the company is mismanaged in terms of internal oversight and data protection.
Coupang Corp. CEO Park Dae-jun has apologized and pledged full cooperation with the authorities. However, Coupang was founded by Korean American Bom Kim in 2010. Kim resigned from Coupang Corp. but kept his position as CEO and board chairman of Coupang Inc., a Delaware-based entity on the New York Stock Exchange. Kim holds about 9 percent of the company's shares, but by holding them mostly in Class B shares with more voting power, he effectively controls 74.3 percent of voting power. Viewed against the potential scale of damage, Kim should step up to take responsibility and follow up with real action. If necessary, the National Assembly should call Kim as a witness and determine remedial measures.