Coupang faces possible suspension after data breach

Coupang is facing possible business suspension in South Korea after a data breach exposed information of 33.7 million users.

The company, which is listed on the New York Stock Exchange and operates a major ecommerce platform in Korea, is under investigation by a joint government task force including the Fair Trade Commission (FTC), Ministry of Science and ICT, National Intelligence Service, and police.

FTC Chairperson Ju Biung-ghi said authorities are considering all regulatory options, including suspension, depending on whether consumers experienced or are at risk of financial losses and if Coupang failed to address the damage.

Deputy Prime Minister Bae Kyung-hoon described the breach as a serious threat to the public.

Coupang interim CEO Harold Rogers told lawmakers that the leaked data was not highly sensitive and did not require an SEC filing.

Industry officials said suspending Coupang’s operations would be difficult without evidence of illegal conduct, and financial penalties are more likely if consumer harm is proven.

🔗 Source: The Korea Times

🧠 Food for thought

Implications, context, and why it matters.

South Korea’s Personal Information Protection Act (PIPA) allows fines up to 3% of revenue 1, while experts question whether suspending Coupang is workable 2.
SK Telecom, South Korea’s largest mobile carrier, had a 2025 breach that hit 23 million users 1. Regulators issued a record 134.8 billion won PIPA fine 1. Unencrypted Subscriber Identity Module (SIM) authentication keys, credentials phones use to connect to a network, and other basic security failures were exposed 1.
Officials ordered fines and service fixes, not a shutdown 1.
Coupang’s interim CEO said the leaked data was “not highly sensitive” and did not require a U.S. Securities and Exchange Commission (SEC) filing, casting this breach as less severe than SK Telecom’s as pressure from Korean lawmakers grows.

After SK Telecom’s breach, 250,000 customers switched, and the CEO warned cancellations could reach 2.5 million if fees are waived 3.
Fintech firms with credit monitoring services (companies that alert consumers to suspicious activity on their credit reports) could add identity protection in Coupang’s app or website, turning 33.7 million affected users into a subscription monitoring market.
Payment service providers (companies that process online transactions) could bundle fraud detection with payments, as SK Telecom deployed a fraud detection system for all customers that set expectations for crisis response 3.
Two breaches (SK Telecom’s 23 million, Coupang’s 33.7 million) reveal infrastructure weaknesses, which gives security vendors room to pitch comprehensive cybersecurity assessment programs like those Korean law firms market to enterprises 4.