Coupang interim CEO leaves South Korea during data leak probe

Harold Rogers, interim CEO of Coupang, has left South Korea following a police summons related to a major data leak affecting 33 million users.

Coupang is an ecommerce company based in South Korea.

Police said Rogers departed on December 31 after appearing at a parliamentary hearing about the breach.

Authorities summoned him for questioning on January 5, but he did not attend.

The Seoul Metropolitan Police Agency has asked the Ministry of Justice to notify them when Rogers returns, and is considering a travel ban upon his arrival.

Coupang said Rogers left for a pre-arranged business commitment and is willing to cooperate with the investigation.

The police are investigating whether Rogers’ parliamentary testimony was accurate, after a committee filed a complaint alleging a violation of testimony laws.

🔗 Source: Yonhap

🧠 Food for thought

Implications, context, and why it matters.

South Korea’s data breach penalties stay modest next to business scale

Coupang’s breach hit 33 million users, while Meta, parent to Facebook plus Instagram, saw 980,000 users affected and paid a $15.67 million fine 1. PIPA permits surcharges up to 3% of revenues tied to the violation 2.
The Personal Information Protection Commission (PIPC) can order security upgrades and require proper data request handling 1. People may seek statutory (set-by-law) damages up to KRW (Korean won) 3 million per person if intent or gross negligence is established 3.
In the Kakao Pay case, involving a South Korean mobile payments service, the PIPC ordered deletion of an AI model 4 and Coupang’s theft driven incident likely shifts penalties to security failures under PIPA’s technical safeguard rules 5.

Breach response vendors see openings under Korea’s 72-hour notification rule

PIPA requires notifying affected individuals within 72 hours in all cases 6. The PIPC must also be notified within 72 hours when 1,000 or more data subjects are hit, sensitive or unique identification information is leaked, or there is unauthorized external access 6. This creates demand for notification tools, call centers, plus identity monitoring.
Security vendors that offer vulnerability analysis can add traffic dispersion services (e.g., load balancing and content delivery network planning) plus chief information security officer advisory advice. They can tie offerings to the Act on Promotion of Information and Communications Network Utilization and Information Protection (Network Act) 6 as the PIPC stresses proactive security planning to minimize harm 3.
Credit monitoring and identity theft protection providers should track that affected users can claim statutory damages without proving specific loss if intent or gross negligence is established 3, which can spur sign-ups among breach victims.