South Korea on Thursday fined e-commerce company Coupang a record 624.7 billion won ($410 million) over privacy violations, including a major data breach affecting more than 37 million users.
Authorities in Seoul launched an investigation last year into Coupang and transactions linked to its US headquarters after the company disclosed that personal data from 33.7 million customers had been compromised, including names, phone numbers, email addresses, and delivery details.
The Personal Information Protection Commission imposed a 423.6-billion-won ($277 million) penalty for the data breach and an additional 201.1-billion-won fine for unauthorized collection of user activity records and other violations, according to the Yonhap news agency.
According to the commission, this marks the largest fine ever imposed by the regulator on a single company.
"The investigation found that this incident happened not by sophisticated hacking, but due to Coupang's inadequate safety management system," said Song Kyung-hee, the head of the commission.
Coupang said that the company plans to "clarify the facts through legal procedures," while expressing regret over the fine.
According to the regulator, data belonging to 37.5 million users were breached in the Coupang incident, a figure higher than earlier estimates.
The watchdog also said it decided to file a complaint against the company for obstructing the investigation.
The breach and subsequent investigation caused friction between Seoul and Washington, amid claims by some US officials and lawmakers that the South Korean unit of US-listed Coupang was being treated unfairly during the probe.
The company was also found to have collected online activity records of about 11.17 million users without their consent.
Coupang Fulfillment Services, the logistics arm of the company, was separately fined 248 million won (about $161,000) for various privacy violations, including compiling a list of journalists and placing them on an employment restriction list.
