Seoul, December 3 (NationPress) – On Wednesday, the data protection authority announced that the prominent e-commerce firm Coupang Inc. failed to adequately inform its customers about a significant data breach. The regulator is insisting that the company issue a revised notification regarding a personal information "leak" rather than merely describing it as an "exposure" of data.

The Personal Information Protection Commission (PIPC) reached this conclusion during an urgent meeting, following Coupang's revelation last week that the personal details of 33.7 million users had been compromised, including their names, addresses, and phone numbers, as reported by the Yonhap news agency.

While Coupang did alert affected customers about the breach, the PIPC criticized the company for describing the situation as a mere exposure of personal information when it was actually a case of leaked data.

Moreover, the authority pointed out that Coupang failed to fully disclose the types of data involved when announcing the breach on its website, which was only available for one to two days.

The PIPC has mandated that Coupang notify the impacted customers again about the leak, provide guidance on protective measures like changing passwords, and reassess its procedures to prevent future harm.

The company has been instructed to report back on the effectiveness of its measures within a week.

In a public statement, the PIPC emphasized, "(We) will swiftly and thoroughly investigate the circumstances, scope, and items of Coupang's personal information leak, as well as violations of safety duties, and will impose strict penalties if violations are found."

Simultaneously, the PIPC announced enhanced monitoring of illegal personal information distribution online and on the dark web, an initiative that will last for three months.

Coupang is currently facing a surge of class-action lawsuits stemming from the data breach that has impacted nearly 34 million customers. A law firm named Chung filed the first suit against Coupang on Monday on behalf of 14 clients, seeking damages of 200,000 won (approximately US$140) per individual. Numerous other law firms are also expressing their intent to join the class-action lawsuits and are actively recruiting participants.

However, legal experts noted on Wednesday that based on past judicial precedents, the compensation awarded to users whose personal information has been leaked typically amounts to around 100,000 won per person.