Short answer
A Seoul Administrative Court rejected Coupang's request to suspend a 423.6 billion won (about $315.6 million) fine for a data breach affecting about 37.5 million users, while pausing the related corrective orders. The regulator imposed the fine in June 2026. Coupang has said it will challenge the decision.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Coupang |
|---|---|
| Incident type | Data breach |
| Status | Confirmed by authorities |
| Sector | E-commerce |
| Country | South Korea |
| Disclosed | 2026-06-10 |
| People or records affected | About 37.5 million users, per South Korea's Personal Information Protection Commission |
What data was exposed
- Personal information of about 37.5 million users, per the regulator; the reports we reviewed do not list the data types
- The regulator ordered Coupang to notify affected people who are not Coupang members
What the court decided
A Seoul Administrative Court rejected Coupang’s request to suspend a 423.6 billion won fine (about $315.6 million) over a personal data breach, Korea JoongAng Daily reported on 5 November 2026. The court did temporarily halt enforcement of the corrective orders, finding they and the related public-disclosure requirements could cause Coupang irreparable harm. They are paused until 30 days after a ruling in the main lawsuit.
A suspension ruling does not decide whether the fine is legally justified. The court is expected to hear Coupang’s main lawsuit seeking to overturn the fine and orders, and no first hearing date has been set.
What the regulator found
South Korea’s Personal Information Protection Commission announced the fine in June 2026. It found that inadequate basic security measures exposed personal information of about 37.5 million users. The Insurance Journal report of the June decision says the commission’s chairperson, Kyung Hee Song, described the breach as the result of management failures rather than a sophisticated attack, “not by a sophisticated hacking method.” It also says a former employee accessed data without authorization and that the intrusion went undetected for months. Those are the regulator’s findings and press reporting, and Coupang can still contest them.
The penalty
The total penalty against Coupang Corp. was 624.7 billion won (about $409 million): 423.6 billion won for the data leak, 201.1 billion won for collecting data without consent, and a separate 248 million won against Coupang Fulfillment Services. The report calls it the largest personal data breach penalty in South Korea, ahead of SK Telecom’s 134.8 billion won fine. A different panel suspended the 201.1 billion won fine separately.
The commission also ordered Coupang to strengthen security, notify affected people who are not Coupang members, and ensure its chief privacy officer can carry out the role.
Coupang’s position
Coupang said it regretted the decision, which “did not fully reflect Coupang’s proactive measures to prevent secondary harm following last year’s data leak.” It said it hopes the facts will be established through legal proceedings after it receives the formal written decision.
What users should do
News of fines and court rulings is a common hook for scammers. Expect fake “compensation” texts and calls. Verify anything through the app, not a link. Our data breach checklist covers account steps, the phishing messages guide helps you check a suspicious message, and the toll and delivery text scams guide covers the fake parcel notices that often follow a retail breach.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Texts and emails posing as Coupang about 'compensation' or 'account verification' that carry a link.
- Calls from fake regulators or lawyers claiming you are owed money from the fine, asking for bank or card details.
- Phishing that uses leaked contact details to impersonate delivery or refund notices.
What to do if you are affected
- 01Ignore messages promising a payout from the fine. Coupang and the regulator have not announced one in the sources we reviewed.
- 02Use the official Coupang app or website, typed in yourself, rather than links in texts or emails.
- 03Change your Coupang password and any account that shares it, and enable two-factor authentication.
- 04Be careful with unexpected delivery, refund or compensation messages, and verify them in the app.
- 05If you are not a member but think you were affected, watch for the notice the regulator ordered Coupang to send.
Frequently asked questions
What did the court decide?
A Seoul Administrative Court rejected Coupang's request to suspend the 423.6 billion won fine. It did suspend enforcement of the corrective orders until 30 days after a ruling in the main lawsuit.
How many users were affected?
The Personal Information Protection Commission found personal information of about 37.5 million users was exposed. One report breaks this into about 33.22 million Coupang users and about 4.33 million other data subjects.
How large is the total penalty?
The commission fined Coupang Corp. a total of 624.7 billion won in June 2026, made up of 423.6 billion won for the leak and 201.1 billion won for non-consensual data collection, plus a separate 248 million won against a subsidiary.
What did Coupang say?
Coupang said the decision did not fully reflect its proactive measures to prevent secondary harm after last year's leak, and that it hopes the facts will be established through legal proceedings.
Is the court ruling final?
No. The court has only ruled on a request to suspend enforcement, which does not decide whether the fine is justified. The main lawsuit seeking to overturn the fine and orders has no first hearing date yet.
Sources
- Court keeps Coupang's record data breach fine in force, Korea JoongAng Daily, 2026-11-05
- South Korea Fines Coupang Record $409 Million for Data Breach, Insurance Journal, 2026-06-12
- Korean court keeps Coupang's record data breach fine in force, delays corrective action plan for 30 days, DataBreaches.net, 2026-11-05
This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.