Korea's PIPC finds Coupang key-management failures exposed 37.55 million people, imposes record ₩624.68B fine

What happened

South Korea’s Personal Information Protection Commission announced sanctions on 11 June 2026, finding that failures in Coupang’s authentication signing-key management and access controls led to the leak of about 37.55 million people’s data, and imposed a ₩624.681 billion penalty surcharge ^[1]. According to Yonhap, the PIPC found the attacker was a former Coupang employee ^[3]. According to the Hankyoreh, Coupang began notifying users of the leak from 29 November 2025 ^[4]. Taiwan’s Administration for Digital Industries said on 24 February 2026 that Coupang Taiwan reported on 23 February and that a review confirmed Taiwan users were affected by the Korea incident ^[6].

Who was affected

According to Yonhap, the leak covered 33.22 million members and at least 4.34 million non-members, and the PIPC said collective dispute mediation would reopen on 12 June with additional participation allowed ^[3]. According to The Korea Herald, the PIPC also found Coupang had collected online activity records of about 11.17 million members without consent ^[2]. ADI said the names, email addresses, phone numbers, delivery addresses and about five recent orders of 204,552 Taiwan users were read without authorization, and directed Coupang Taiwan to notify those users under the Personal Data Protection Act, set up a dedicated help channel and prepare compensation ^[6].

What to do

Korean police advise deleting messages and links from unknown sources and refusing any request by phone or text to install an app ^[5]. ADI advised Coupang Taiwan users to stay alert, verify suspicious messages, not click unknown links, and not give passwords, one-time codes or national ID numbers; if something looks suspicious, call Taiwan’s 165 anti-fraud line .