Coupang Challenges South Korea’s Record $462 Million Data-Breach Fines in Two Lawsuits

Coupang filed two administrative lawsuits in the Seoul Administrative Court on October 7, 2026, asking the court to cancel the penalties that South Korea’s Personal Information Protection Commission (PIPC) imposed in June over a massive data breach and the unauthorized collection of users’ online activity records. Reporting says Coupang also applied for a stay of execution with each suit, which would temporarily suspend the fines while the cases proceed.

The combined penalty surcharges are KRW 624.681 billion, reported in U.S. dollars as roughly $462 million at the exchange rate used in October 8 coverage. The PIPC called the breach fine the largest ever imposed for a single leak in South Korea, and the total the largest against a single company for multiple violations.

These lawsuits are a company challenging a government penalty. They are not a consumer class action, and they do not create a payment program. Separate compensation developments for Korean users are covered below, including a mediation order that Coupang rejected. Nothing in the lawsuits entitles people in the United States or anywhere else to a payment. A court has not ruled on either lawsuit, and the fines have not been cancelled.

Coupang vs. South Korea’s PIPC: Quick Facts

Detail	Information
Company	Coupang. The fines were imposed on Coupang Corp., the Korean subsidiary of NYSE-listed Coupang, Inc.
Regulator	Personal Information Protection Commission (PIPC), South Korea
Court	Seoul Administrative Court
Lawsuits filed	October 7, 2026 (two suits, one per penalty)
Relief sought	Cancellation of the penalties, plus stays of execution
Penalty for the data breach	KRW 423.575 billion
Penalty for unauthorized online-behavior data collection	KRW 201.106 billion
Combined penalty surcharges	KRW 624.681 billion
Separate administrative fine	KRW 16.8 million
Separate penalty on Coupang Fulfillment Services	KRW 248 million (reportedly not being challenged at this time)
PIPC decision date	June 10, 2026
People affected (PIPC)	About 37.5 million: about 33.2 million Coupang members and about 4.3 million non-members
Case numbers	Not publicly reported in the sources reviewed
Court ruling	None reported
Public claim form	None for these lawsuits

Why Did Coupang Sue South Korea’s Privacy Regulator?

Coupang says the commission’s decision did not fully reflect its steps to prevent secondary damage after the breach or its fact-based explanations. After the June announcement, the company stated that it would pursue judicial relief in the Seoul Administrative Court and noted in a filing with the U.S. Securities and Exchange Commission that fines paid to the PIPC are not automatically stayed during an appeal and are not tax deductible.

Coupang filed one suit for each penalty: one over the KRW 423.575 billion breach fine and one over the KRW 201.106 billion fine for collecting online activity records. The legal arguments in the court filings have not been published, so this article does not attribute specific arguments to either side beyond what the parties have said publicly. The PIPC chair said in June that the commission would respond vigorously if a lawsuit were filed and called the penalty a well-grounded decision.

What Is a Stay of Execution in a South Korean Administrative Lawsuit?

Under South Korea’s Administrative Litigation Act, a court can suspend the effect of an administrative decision while a cancellation suit is pending if continued enforcement could cause harm that is hard to repair and there is an urgent need to prevent it (Article 23). Filing a lawsuit alone does not suspend a fine. No ruling on Coupang’s stay applications had been reported as of October 9, 2026.

What Did the PIPC Find About the Coupang Data Breach?

According to the PIPC’s findings as reported, the breach resulted from weak basic security, not an advanced attack. The commission pointed to failures in managing authentication signing keys and controlling system access, and to a failure to detect unusual access.

As described in the PIPC announcement, a former Coupang employee had access to authentication-signing keys while employed and later used forged tokens to get into Coupang’s systems between April and November 2025. Coupang reported the breach to the PIPC on November 20, 2025.

The exposed information included names, email addresses, phone numbers and delivery details. The PIPC also said shipping information belonging to people who were not Coupang members was affected, including names, phone numbers, addresses, order information and building-access passwords.

How Many People Were Affected by the Coupang Breach?

The PIPC found that about 37.5 million people were affected: roughly 33.2 million Coupang members and 4.3 million non-members. Coupang’s own compensation program counted about 33.7 million customers, so counts vary by source and by how records were counted.

Other PIPC Findings Against Coupang

• Late notification. The PIPC said Coupang did not notify authorities within the required 72 hours after becoming aware of a later leak involving about 160,000 users’ delivery-address information (January 30, 2026).
• Deleted logs. The PIPC said Coupang manually deleted about five months of web access logs, covering July through November 2024, after it had been ordered to preserve evidence. The commission said this made it harder to determine when the incident began and how far it went.

These are the regulator’s findings. A court has not decided whether they are correct.

Why Did the PIPC Fine Coupang for Online Tracking?

The second penalty, KRW 201.106 billion, is separate from the breach. The PIPC found that Coupang collected records of about 11.17 million users’ activity on third-party websites and apps, including about 15.645 million webpage-access logs, without a proper legal basis or adequate notice. The records included visited URLs, access times, IP addresses and device identifiers, which the commission said could count as personal information when linked to membership numbers and device identifiers. Coupang’s SEC filing describes this fine as connected to the collection and storage of data related to a third-party advertising program.

How Large Are the Penalties in Dollars?

The Korean-won amounts are the reliable figures. Dollar conversions vary with the exchange rate:

Source and date	Reported dollar figure
Coupang SEC filing, June 10, 2026	About $278 million (breach) and $132 million (third-party data collection), roughly $410 million combined
Korea Times / Yonhap, October 8, 2026	About $462 million for roughly KRW 620 billion in fines challenged

The two main surcharges add up to KRW 624.681 billion (KRW 423.575 billion plus KRW 201.106 billion). The KRW 16.8 million administrative fine and the KRW 248 million penalty on Coupang Fulfillment Services are additional amounts. Under South Korea’s Personal Information Protection Act, a company can be fined up to 3 percent of relevant annual sales for certain violations. Coupang’s sales average about KRW 36 trillion a year over the past three years, according to Yonhap.

Can Coupang Users Get Compensation?

The fines and the lawsuits themselves create no consumer payment program. Compensation for affected users has moved on separate tracks.

Coupang’s Voluntary Compensation

Coupang gave about 33.7 million customers whose data was exposed shopping vouchers worth KRW 50,000 each. Coupang says its voluntary compensation program is worth about KRW 1.685 trillion.

The Consumer Dispute Mediation Order

On July 31, 2026, a consumer dispute mediation committee under the Korea Consumer Agency found Coupang liable for damages and proposed that it pay KRW 100,000 per person, in cash or Coupang Cash, to 50 consumers who applied for collective mediation. The committee said that if Coupang accepted, it would seek a plan to give the same compensation to victims who did not take part. Reporting estimated that extending this to everyone affected could reach about KRW 3.7 trillion.

Coupang rejected the proposal. The company notified the committee in writing on or about September 11, 2026, citing its own voluntary compensation and its measures to protect personal information, and saying no secondary damage had been confirmed. With the rejection, reporting says disputes over additional compensation are now more likely to move into civil litigation.

Group Mediation Through the Personal Information Dispute Mediation Committee

Separately, the Personal Information Dispute Mediation Committee merged two group mediation cases, one with 50 participants and one with 1,626, and reopened applications for users who had received a breach notice. The application deadline was June 26, 2026, and it has passed. Under the process described, a mediation proposal was to be drafted within 60 days of the deadline, and the mediation fails if either side rejects it. The outcome of this track was not found in the reporting reviewed. The two tracks are reported separately, and it is not clear from the coverage how they relate.

Civil Lawsuits Under the Personal Information Protection Act

South Korea’s Personal Information Protection Act (PIPA) allows affected people to seek damages in court. As I understand the statute, Article 39 makes a company that causes harm through a violation liable unless it proves it was not at fault, and Article 39-2 allows a court to award statutory damages without proof of the exact loss. Whether a particular person has a viable claim depends on the facts, and the fines paid to the government do not create a right to payment. Under Korea’s Civil Act (Article 766), damage claims generally expire three years after the injured person knows of the damage and the responsible party, and ten years after the act, so anyone considering a claim should get advice from a lawyer in South Korea promptly.

Does the Coupang Case Affect U.S. Customers?

The PIPC’s decision concerns Coupang’s handling of data of people in South Korea. The lawsuits are in South Korea’s court system. None of the reporting reviewed identifies a U.S. consumer settlement or class action tied to this incident, so U.S. residents should not expect a payment from it.

If you receive a breach notice from any company, follow the instructions in that notice and verify any claim website against official sources. For an example of a U.S. data-breach settlement with a real claims process, see our report on ABC Legal Services Data Breach Settlement, Check If You Qualify. It involves a different company and is unrelated to Coupang.

Practical Steps for People Affected by a Data Breach

1. Check for an official notice from the company and from the regulator.
2. Change reused passwords and turn on two-step verification.
3. Be cautious with unexpected delivery messages, verification links and payment requests that use real delivery details.
4. Keep notices, suspicious messages and records of any losses.
5. Confirm any claim process through an official notice or government announcement before sharing personal information.

What Happens Next in the Coupang Lawsuits?

The Seoul Administrative Court will decide the stay applications and then the merits. Intermediate rulings on stays can come relatively quickly, while a full decision can take much longer and can be appealed. The court could uphold the fines, reduce them or cancel them in whole or in part. Things to watch:

1. Whether the court grants a stay of execution
2. The case numbers and the parties’ filed arguments
3. The PIPC’s response to the suits
4. Whether affected users bring civil lawsuits after Coupang’s rejection of the mediation order

Key Dates in the Coupang Privacy Penalty Dispute

Date	Event
November 20, 2025	Coupang reports the breach to the PIPC (per the PIPC)
February 9, 2026	Group mediation suspended during the PIPC investigation
June 10, 2026	PIPC resolves to impose the penalties; Coupang says it will seek judicial relief
June 26, 2026	Deadline for additional group-mediation applications (passed)
July 31, 2026	Consumer dispute committee orders KRW 100,000 per person for 50 consumers
About September 11, 2026	Coupang rejects the mediation proposal in writing
October 7, 2026	Coupang files two lawsuits in the Seoul Administrative Court and applies for stays
October 8, 2026	News outlets report the lawsuits

Frequently Asked Questions About Coupang’s South Korea Privacy Lawsuits

Why is Coupang suing South Korea’s privacy regulator?

Coupang filed two administrative lawsuits asking the Seoul Administrative Court to cancel KRW 624.681 billion in penalties. It says the PIPC’s decision did not fully reflect its steps to limit harm after the breach.

How much was Coupang fined?

KRW 624.681 billion in penalty surcharges (KRW 423.575 billion for the breach and KRW 201.106 billion for unauthorized collection of online activity records), plus a KRW 16.8 million administrative fine. Coupang Fulfillment Services was fined KRW 248 million separately.

How many people were affected?

The PIPC found about 37.5 million people were affected, including about 33.2 million members and 4.3 million non-members. Coupang’s own program counted about 33.7 million customers.

Has a court cancelled the fines?

No. No ruling has been reported, and filing a lawsuit does not cancel a fine.

Can Coupang users claim a share of the fines?

No. The fines are regulatory penalties paid to the government, not a consumer fund.

Did Coupang agree to pay compensation to users?

Coupang gave about 33.7 million customers KRW 50,000 vouchers, but it rejected a mediation proposal to pay KRW 100,000 per person to 50 consumers.

Are U.S. customers covered?

No U.S. settlement or payment program tied to this incident was found. The PIPC decision concerns users in South Korea.

Is the group-mediation deadline still open?

No. The deadline for additional applications was June 26, 2026.

Sources and Legal References

1. South Korea Personal Information Protection Commission, The PIPC Sanctions Coupang and CFS for Data Breaches and Infringements on Privacy, June 11, 2026 (official announcement; the site blocked automated access, so its contents are taken from reporting and prior drafts)
2. Coupang, Inc., Form 8-K, June 10, 2026 (SEC filing)
3. The Korea Times / Yonhap, Coupang files lawsuits against 620 bil. won fine over data leak, October 8, 2026
4. The Korea Herald, Coupang challenges record W624.7b privacy fine in court, October 8, 2026
5. Seoul Economic Daily, Coupang Sues Over 624.7 Billion Won Privacy Fines, October 8, 2026
6. The Korea Times, Coupang ordered to pay data breach victims $70 each, July 31, 2026
7. The Herald Business, Coupang rejects order to pay 100,000 won per customer, September 17, 2026
8. The Herald Business, Privacy watchdog reopens Coupang group dispute process, June 12, 2026
9. South Korea’s Personal Information Protection Act, Articles 39 and 39-2; Administrative Litigation Act, Article 23; Civil Act, Article 766

Source note: The Seoul Administrative Court filings and case numbers were not available, so the lawsuit details come from news reports. PIPC findings are described as the regulator reported them. A court has not ruled on them.

This article provides general legal information, not legal advice. AllAboutLawyer.com is not a law firm. Laws and procedures differ by country. Consult a qualified lawyer in South Korea about any claim there.

Researched and written by Israr Ahmad, legal content researcher and founder of AllAboutLawyer.com. All facts verified against Coupang’s SEC filing, Korean and international news reports of the court filings, the mediation decisions and the PIPC findings, as of October 9, 2026. Last Updated: October 9, 2026.