The government is set to decide on July 10 the level of sanctions against Coupang, where 33,673,817 pieces of personal information were leaked.
The Personal Information Protection Commission said on July 9 it will hold a full meeting on the 10th to review a sanctions plan against Coupang. It comes about seven months after the leak of personal information at Coupang became known in Nov. 2025.
A public-private joint investigation team at the Ministry of Science and ICT announced the results in Feb. and said 33,673,817 pieces of personal information, including users' names and email addresses, were leaked through a vulnerability on Coupang's "Edit my information" page.
The Personal Information Protection Commission in April sent Coupang a prior notice that included violations of the Personal Information Protection Act and the planned disposition. Coupang then requested an extension of the deadline to submit its opinion and later submitted an explanation, according to reports.
At the full meeting, the Personal Information Protection Commission plans to discuss whether Coupang violated the Personal Information Protection Act and the level of sanctions, including a penalty surcharge. The exact amount of the penalty surcharge and the details of the disposition will be finalized after a review by the Commission.
In the industry, many expect Coupang to face a record-high penalty surcharge, given the scale of the leak and how the company responded to the incident.
Under the Personal Information Protection Act, a penalty surcharge of up to 3% of sales can be imposed in the event of a personal information leak. Coupang's sales last year were 45.5 trillion won, and by simple calculation, the maximum possible penalty surcharge would be 1.365 trillion won.
However, the actual penalty surcharge is calculated by comprehensively considering the nature and degree of the violation, the scale of damage, and the response measures after the incident. Accordingly, some expect it will not reach the statutory cap. The largest penalty surcharge imposed by the Personal Information Protection Commission to date is 134.8 billion won, levied last year in connection with SK Telecom's USIM information leak.