KB News Desk
Coupang was ordered to compensate victims of a major personal data leak with 100,000 won ($70) each in either cash or Coupang Cash, South Korea’s Consumer Dispute Settlement Commission ruled Friday, marking the first case in which the e-commerce company has been found liable for damages over such a breach.
The commission said it reached the decision after reviewing a collective dispute mediation request filed by 50 consumers affected by last year’s leak.
It found Coupang liable for emotional distress, citing the nature of the information exposed and the possibility of actual misuse.
Data of nearly entire consumer base stolen
E-commerce giant Coupang admitted in December 2025 to the leak of personal information related to 33.7 million users — nearly its entire customer base. A subsequent government probe found the actual number of people affected could be as high as 37.56 million.
The leaked data included not only names, email addresses and home addresses, but also information closely tied to private life, such as apartment entrance passwords and order histories.
The commission noted in Friday’s ruling that hackers had extracted information over an extended period and, in some cases, directly emailed customers, indicating that the data could have been misused.
Although Coupang argued there remains no possibility of additional leaks, the commission said that could not be conclusively established.
It set compensation at 100,000 won per person, taking into account past court rulings that have generally awarded around that amount in such extensive data breach cases, the sensitivity of the leaked information and Coupang’s failure to submit data on the actual use of its own compensation program.
Applicants may choose to receive the compensation in cash or Coupang Cash.
Coupang must notify the commission within 15 days of receiving the decision whether it accepts the proposed settlement. If the company does not respond, it will be deemed to have accepted it.
If both sides accept the mediation, the agreement will carry the same legal effect as a court settlement.
Should Coupang accept the decision, the commission plans to proceed with follow-up measures aimed at extending the same compensation to other victims who did not participate in the collective dispute mediation.
If all 37.56 million affected individuals were to seek compensation at the same rate, the total payout could reach about 3.7 trillion won.
The Personal Information Protection Commission in June imposed 624.68 billion won in fines and 16.8 million won in administrative penalties on Coupang over the leak and other violations, including the collection of personal information without a legal basis.
The penalty was the largest ever imposed in Korea for violations of the Personal Information Protection Act.
Coupang had previously offered 50,000 won shopping vouchers to 33.7 million people whose personal information was exposed after the breach was disclosed in January.
Coupang said it would closely review the Consumer Dispute Settlement Commission’s proposal after receiving the formal decision.
