Coupang’s record privacy fine sparks proportionality debate, investment concerns

A Coupang delivery truck is parked in front of a Coupang logistics center in downtown Seoul, Dec. 30. Korea Times photo by Lim Ji-hoon

The record-high 624.68 billion won ($409 million) penalty imposed on Coupang over a massive data breach is fueling debate over regulatory proportionality, as the e-commerce giant was ordered to pay more than four times the fine levied on SK Telecom for last year's hacking incident, while matchmaking company Duo received a far lighter sanction despite a breach involving highly sensitive personal information.

The penalty is also casting doubt on Coupang’s ability to maintain the aggressive investment that has driven its growth, fueling speculation that the e-commerce giant could rein in future spending.

On Thursday, the Personal Information Protection Commission (PIPC) imposed a 624.68 billion won fine and a 16.8 million won administrative penalty on Coupang over its data breach, involving more than 33 million users, and related privacy violations.

The regulator concluded that Coupang failed to maintain even basic security safeguards, citing lax management of an authentication signing key and inadequate access controls that allowed a former employee to forge tokens and reach pages containing customer data.

The sanction is more than four times larger than the previous record of 134.8 billion won imposed on SK Telecom and is roughly equivalent to its U.S.-listed parent company Coupang Inc.’s operating income last year of about $473 million.

Personal Information Protection Commission Chairperson Song Kyung-hee speaks during a briefing on Coupang's data breach at Government Complex Seoul, Thursday. Yonhap

The size of the penalty has fueled comparisons with other privacy cases, highlighting questions over the consistency of Korea’s enforcement framework.

Duo, a matchmaking company, was fined only 1.2 billion won after a hacking incident exposed sensitive personal information of more than 427,000 members, including religion, educational background, marital history, height and weight.

The company’s smaller scale and lower revenue base significantly reduced its financial exposure under the current system, which calculates penalties primarily as a percentage of revenue.

Under the law, maximum fines are set as a percentage of a company’s average revenue over the previous three years, excluding sales unrelated to the violation, with brackets ranging from 0.9 percent to 3 percent depending on the severity of the offense.

That framework means large platforms like Coupang can face multihundred‑billion won sanctions for breaches that end up being far more expensive than incidents at smaller businesses.

Jung Yeon-sung, a business administration professor at Dankook University, questioned the appropriateness of the penalty.

“When evaluating a penalty, factors such as the extent of damage, appropriateness, causation, intent and objectivity should all be considered,” he said. “From my overall perspective, I think the size of the fine may be somewhat excessive.”

Jung warned that the fallout would go well beyond a single year’s earnings, arguing that a penalty of that size risks eroding service quality and damaging Coupang’s brand.

“The impact on Coupang will be extremely significant,” he said. “There is a risk of retreat in areas such as customer service and other parts of the business. Simply receiving a sanction like this severely damages the company’s image, and trust among customers will fall, so Coupang could find itself in a very difficult position.”

The record penalty has also raised concerns that it could weigh on Coupang's long-term expansion plans. The company is currently pursuing a multiyear logistics buildout across Korea while continuing to invest in growth businesses, including food delivery service Coupang Eats, streaming platform Coupang Play and overseas operations in Taiwan and Japan.

Former Tottenham Hotspur player Son Heung-min waves at the audience in a Coupang Play Series match against Newcastle United at Seoul World Cup Stadium, Aug. 3. Yonhap

The company has invested more than 6 trillion won in infrastructure to build its logistics networks in Korea through 2023, and committed an additional 3 trillion won since 2024 to this year.

New logistics facilities are under construction in locations including Busan and Jecheon, North Chungcheong Province, as part of its effort to expand its overnight delivery service coverage nationwide.

However, with profitability coming under renewed pressure, sustaining the same pace of investment could become increasingly challenging.

“Because the penalty is on par with Coupang Inc.’s operating income, investment is likely to be curtailed going forward,” Jung said.

“Across the business as a whole, the company will also have to spend more on compliance-related areas, and that, too, will act as a factor that leaves the organization more constrained.”

Coupang already reported a 354.5 billion won operating loss in the first quarter after recording customer compensation expenses tied to the breach. The latest fine will likely deepen second-quarter losses because accounting rules generally require such penalties to be recognized when imposed, regardless of ongoing legal challenges.

The professor added that the case could weaken consumer trust across the broader online retail sector while potentially benefiting rivals competing with Coupang for market share.

The PIPC said it plans to file a criminal complaint against Coupang over alleged obstruction of its investigation, saying the company deleted access logs and took other actions that made the probe more difficult.

Coupang has signaled it will challenge the penalty in court, arguing that the proactive steps it took to prevent secondary harm were not adequately reflected in the commission’s decision.