South Korean regulators imposed a record 624.7 billion won ($409 million) fine on Coupang for a 2025 data leak that exposed approximately 33.7 million user accounts. The breach triggered diplomatic tensions between Seoul and Washington.
South Korea's Personal Information Protection Commission delivered the penalty to Coupang, the country's largest e-commerce platform and a US-listed company, for a cybersecurity incident that compromised data on a scale affecting roughly two-thirds of South Korea's population.
The fine represents the largest penalty issued by South Korean regulators for a data protection violation. It reflects the severity of the breach and the platform's failure to implement adequate security measures to protect customer information.
Coupang, known for its fast delivery logistics network and subscription services, discovered the intrusion in 2025. The incident exposed sensitive personal data including names, phone numbers, email addresses, and payment information belonging to millions of users across South Korea.
The breach escalated beyond a corporate data security issue into a diplomatic matter between South Korea and the United States. The US government raised concerns about the incident's handling and data protection standards, particularly given Coupang's status as a major technology company and its role in the South Korean economy.
The regulatory action underscores growing pressure on tech companies to strengthen cybersecurity infrastructure and comply with data protection regulations. South Korea has implemented increasingly stringent penalties for companies that fail to safeguard personal information, signaling stricter enforcement of privacy laws.
Coupang has not publicly disclosed detailed remediation efforts beyond the regulatory settlement. The company operates in a competitive landscape where customer trust and data security are critical competitive factors.
The incident marks a significant moment for Asian tech regulation, demonstrating that even major regional platforms face substantial consequences for security lapses. It also highlights the intersection of corporate accountability, national security concerns, and international relations in the digital economy.
A cross-site request forgery (CSRF) vulnerability in WordPress Core, dubbed 'Click2Shell,' enables attackers to execute PHP code on vulnerable servers. Technical details and working exploits are now public.
The ShinyHunters extortion group took control of the dark web leak site belonging to the prolific Cl0p ransomware gang over the weekend. The attackers set an eight-figure extortion demand pegged at 2.333% of Cl0p's estimated net worth.
The FBI's CJIS Security Policy v6.1 strengthens encryption requirements and vulnerability scanning mandates. Agencies must prepare for updated password, MFA, and identity verification standards ahead of compliance audits.
New research reveals that digital watermarks intended to protect content ownership are being repurposed as surveillance mechanisms to track user behavior and identify individuals across platforms.