South Korea's data protection authority on Thursday imposed a record fine of 624.7 billion won ($410 million) on e-commerce giant Coupang over sweeping privacy violations, including a massive data breach that compromised the personal information of more than 37 million users. The penalty is the largest ever levied by the regulator against a single company.

Breakdown of the Record Fine

The Personal Information Protection Commission (PIPC) structured the penalty in two parts: 423.6 billion won for the data breach itself, and an additional 201.1 billion won for the unauthorised collection of online user activity records and related violations. Combined, the 624.7 billion won total dwarfs the previous record — a 134.8 billion won fine imposed on wireless carrier SK Telecom Co. last August over a separate major data leak — more than tripling it.

What the Breach Involved

Coupang disclosed the large-scale breach last November, more than six months before Thursday's ruling. The compromised data included names, phone numbers, and delivery details of users across South Korea. The PIPC concluded that approximately 37.5 million individuals were affected — around 33.2 million registered members and 4.3 million non-member users who had interacted with the platform.

Beyond the breach, regulators found that Coupang had collected browsing records — including websites and applications visited — of 11.17 million users who accessed third-party services, without obtaining their consent. The company was also found to have failed to adequately oversee advertising partners that ran so-called 'hi-jacking' advertisements on its platform.

What the Regulator Said

Song Kyung-hee, chief of the Personal Information Protection Commission, said at a briefing: 'Coupang is a company that grew dramatically by offering an innovative e-commerce service based on large-scale customer information. But our investigation confirmed that it did not have a system to protect and manage personal information commensurate to that.'

The statement signals a broader regulatory posture: scale of data collection must be matched by proportionate investment in data governance — a standard that Coupang, according to the PIPC, failed to meet.

Logistics Arm Also Penalised

Separately, Coupang Fulfillment Services, the company's logistics subsidiary, was fined an additional 248 million won for distinct privacy violations. These included compiling a list of journalists and placing them on an employment restriction list — a finding that drew particular attention given its implications for press freedom and worker rights.

What Comes Next

Coupang has not yet publicly detailed whether it will contest the fines. The ruling is expected to reverberate across South Korea's tech and e-commerce sector, where data-driven growth models have outpaced regulatory compliance frameworks. This case sets a new enforcement benchmark and may accelerate legislative scrutiny of how platforms handle user data at scale.