South Korean regulators imposed a record 624.7 billion won ($409 million) fine on Coupang for a 2025 data leak that exposed approximately 33.7 million user accounts. The breach triggered diplomatic tensions between Seoul and Washington.
South Korea's Personal Information Protection Commission delivered the penalty to Coupang, the country's largest e-commerce platform and a US-listed company, for a cybersecurity incident that compromised data on a scale affecting roughly two-thirds of South Korea's population.
The fine represents the largest penalty issued by South Korean regulators for a data protection violation. It reflects the severity of the breach and the platform's failure to implement adequate security measures to protect customer information.
Coupang, known for its fast delivery logistics network and subscription services, discovered the intrusion in 2025. The incident exposed sensitive personal data including names, phone numbers, email addresses, and payment information belonging to millions of users across South Korea.
The breach escalated beyond a corporate data security issue into a diplomatic matter between South Korea and the United States. The US government raised concerns about the incident's handling and data protection standards, particularly given Coupang's status as a major technology company and its role in the South Korean economy.
The regulatory action underscores growing pressure on tech companies to strengthen cybersecurity infrastructure and comply with data protection regulations. South Korea has implemented increasingly stringent penalties for companies that fail to safeguard personal information, signaling stricter enforcement of privacy laws.
Coupang has not publicly disclosed detailed remediation efforts beyond the regulatory settlement. The company operates in a competitive landscape where customer trust and data security are critical competitive factors.
The incident marks a significant moment for Asian tech regulation, demonstrating that even major regional platforms face substantial consequences for security lapses. It also highlights the intersection of corporate accountability, national security concerns, and international relations in the digital economy.
Cyberattacks against hedge funds and private equity firms have been attributed to UNC6671, an extortion group connected to the BlackFile threat actors. The campaign represents an escalating threat to the financial sector.
A Go-based malware distributed through ClickFix attacks is targeting macOS users to steal cryptocurrency, passwords, and Apple Keychain data. The infostealer campaign combines social engineering with credential harvesting.
A former NSA official has warned against connecting water infrastructure controllers to the internet following suspected Iranian cyberattacks on U.S. water systems.
Security researchers scanning Polish government websites discovered critical vulnerabilities that could expose courts, hospitals, and airports to cyberattacks. The vulnerabilities stem from common software used to manage and display web content.