SEOUL South Korea’s authorities are set to wrap up their investigation into a massive data breach at e-commerce giant Coupang early next month, with the company potentially facing one of the country’s largest fines ever for mishandling user data.
The Personal Information Protection Commission (PIPC), which conducted the investigation, completed its review and issued an advance notice of proposed penalties to Coupang.
In early April, industry sources said. Under regulations, companies have at least 14 days to respond, and Coupang requested an extension which was granted submitting a detailed objection to most of the proposed penalties.
While the notice outlines sanctions, legal reasoning, and response deadlines, it does not specify the exact fine.
Experts now expect the final ruling in June due to the sheer volume of documents the company submitted in its defense.
The breach, revealed last November, affected tens of millions of Coupang users, raising fears of a record-breaking penalty.
Under Korea’s Personal Information Protection Act, fines can reach up to 3% of a company’s average annual sales over the past three years. Coupang’s parent company, listed on the New York Stock Exchange, posted 49 trillion won ($33 billion) in sales last year theoretically making the maximum fine 1.47 trillion won.
However, analysts say this is unlikely, as some business segments would be excluded from the calculation. The largest PIPC fine to date was 135 billion won, imposed on SK Telecom last year.
Coupang is also facing regulatory tension after its founder, “Bom Kim”, was legally designated as the company’s “same person” meaning he is considered the effective controller and is subject to stricter oversight.
Coupang has filed a lawsuit to overturn this designation, arguing that management responsibilities are shared, including by Kim’s brother, Yoo-seok.
The investigation and leadership disputes come at a critical time for Coupang, as public scrutiny and regulatory pressure mount.
With millions of users affected and billions at stake, the coming weeks could redefine accountability in South Korea’s tech industry and send a powerful message that even the largest companies are not above the law.
