South Korea's Personal Information Protection Commission has fined e-commerce giant Coupang a record 624.7 billion won ($409 million) following a data breach that exposed 33.7 million customer accounts — roughly two-thirds of South Korea's population. A former employee who was a Chinese national stole a cryptographic signing key and accessed customer data undetected for nearly five months. The fine comprises two parts: 423.6 billion won for inadequate key management and lax access controls, and 201.1 billion won for unauthorized collection of browsing data from 11.17 million users. Coupang also missed the legally mandated 24-hour breach notification window. Beyond the fine, the company announced a $1.17 billion customer compensation plan, its CEO resigned, and its stock is down ~32% year-to-date. The case has sparked a US-South Korea diplomatic dispute, with Republican lawmakers accusing Seoul of targeting a US-listed company, and speculation that it contributed to raised tariffs on South Korean goods.
