Consumer Panel Rules Coupang Liable for Data Breach, Orders Compensation for 50 Victims

Coupang’s breach affected far more users than initially disclosed: 33.7 million users were admitted by Coupang in December 2025, with a government probe later finding the number could be as high as 37.56 million.
In June, South Korea’s Personal Information Protection Commission imposed a record-high fine of 624.68 billion won on Coupang for the breach and related violations.
The breach was disclosed after a former employee leaked personal data to the public last November, affecting tens of millions and provoking anger over the company’s failure to detect and respond promptly.
The mediation process began with 50 consumers filing for collective dispute mediation on Dec. 8, with the Consumer Dispute Settlement Commission starting proceedings on Apr. 6 and holding sessions on July 10 and 22.
A South Korean consumer panel has found Coupang liable for damages from its massive personal data breach — the first time the e-commerce giant has been held responsible. The Consumer Dispute Settlement Commission ordered Coupang to pay 100,000 won (about $70) each to 50 victims, according to Korea JoongAng Daily and Korea Herald.
The breach exposed the personal data of up to 37.56 million customers — nearly Coupang's entire user base. The ruling marks the first official acknowledgement that Coupang owes its customers compensation, and it could open the door to a payout totaling as much as $2.6 billion, KED Global reported.
The commission ruled that Coupang must pay each of the 50 claimants 100,000 won in cash or Coupang Cash, according to Seoul Economic Daily. Coupang now has 15 days to accept or reject the proposed settlement. If accepted, the deal carries the same legal weight as a court-approved settlement.
The panel cited the extreme sensitivity of the leaked data. It included names, emails, home addresses, apartment entrance passwords, and full order histories. The commission said customers trusted Coupang with this information and suffered real emotional distress when it was exposed, Korea Herald reported.
The crisis began last November when a former Coupang employee leaked customer data to the public. Coupang failed to detect the leak quickly, which drew sharp criticism from customers and regulators alike. The company initially said 33.7 million users were affected, admitting that number in December 2025.
A government investigation later found the true number could be as high as 37.56 million, according to Korea JoongAng Daily. That would make it one of the largest personal data breaches in South Korean history. Critics were especially angry that Coupang took so long to discover and disclose the leak.
Before this ruling, South Korea's Personal Information Protection Commission hit Coupang with a record fine of 624.68 billion won in June for the breach and related violations. It was the largest data-privacy fine ever imposed in South Korea, Korea JoongAng Daily reported.
Coupang CEO Bom Kim issued his first public apology over the incident, according to KED Global. The apology came as the company faced mounting legal and regulatory pressure. The combination of the government fine and this new compensation ruling signals that scrutiny of Coupang's data practices is far from over.
The 50 consumers who filed for collective mediation on December 8 started a process that took months. The commission opened proceedings on April 6 and held hearings on July 10 and July 22, according to Korea Herald. Now that a ruling has been issued, experts say it sets a legal precedent.
If Coupang accepts the settlement, regulators could launch follow-up measures to compensate victims not included in this round. With up to 37.56 million affected users, a full payout at 100,000 won each could reach roughly 3.76 trillion won — close to the $2.6 billion figure cited by KED Global.
Publishers
13
Articles
5
Reach
18