Coupang may face probe after 33.7 million-user data leak

South Korea’s Fair Trade Commission (FTC) may investigate Coupang after a major data leak exposed personal information of about 33.7 million customers starting in June, according to FTC officials.

Coupang, a Seoul-based ecommerce company, is facing a potential class action lawsuit as hundreds of thousands of affected users seek legal action.

The FTC said it could begin an inquiry if the Korea Consumer Agency, a government-linked consumer protection body, requests help following victim complaints.

Although Coupang founder Bom Kim holds significant management influence, the FTC said it does not plan to designate him as the company’s legal chief since he is a US citizen and current regulations do not require it.

🔗 Source: The Korea Times

🧠 Food for thought

Implications, context, and why it matters.

PIPA requires companies (controllers) to notify people within 72 hours of awareness, and to report to regulators within 72 hours if 1,000 or more are affected 1. Coupang, a Seoul-based ecommerce company, had a breach from June 24 to November 18 that hit 33.7 million customers, roughly three in four South Korean adults 2, and it went undetected for over five months 3.
Leaked data covered names and emails plus phone numbers 3. Shipping addresses were included, not payment credentials, with some order histories 3. Mandatory notices went to the Korea Internet & Security Agency (KISA) plus the Personal Information Protection Commission 4, with penalties under PIPA that include imprisonment up to five years and a criminal fine up to KRW 50 million plus punitive damages up to five times the harm 1.
With 33.7 million South Koreans affected 3, authorities warn of scams and identity theft 5, while Experian reports a 650% jump in records on the dark web since 2019 6. Demand is rising for dark web monitoring, credit locks, and identity restoration 6.
Vendors with CyberAgent-style monitoring (CyberAgent is a Japanese internet firm that provides consumer dark web monitoring) 6 and credit freeze tools can partner with Korean credit bureaus (consumer credit reporting agencies) 5. Police have not received reports of smishing or voice phishing tied to this breach 2.