A dispute over the truth erupted between civic groups and Coupang regarding findings that there were no secondary damages such as payment information misuse after Coupang's massive personal data leak. The civic groups said suspected cases of unauthorized payments had been reported and called for further investigation, while Coupang countered that the claims were baseless.
According to related industries on the 24th, People's Solidarity for Participatory Democracy (PSPD) and the Minbyun People's Livelihood and Economy Committee said the previous day that they had asked the Seoul Metropolitan Police Agency to investigate one tip suspected to involve an unauthorized Coupang payment. Of the seven suspected unauthorized payment cases received by a reporting center that operated for about a month from Dec. 4 last year to Jan. 4 this year, this is follow-up action on a case in which the complainant wanted an investigation.
According to People's Solidarity for Participatory Democracy (PSPD), this complainant said goods worth 280,000 won (a radio-controlled airplane) were paid for with a credit card registered for automatic payment at Coupang. The complainant was sleeping at the time of payment and belatedly found the charge, then asked Coupang to cancel it.
An official at People's Solidarity for Participatory Democracy (PSPD) said, "There was also a report that a card used only at Coupang was used on the overseas open market eBay, with payment and cancellation repeated 11 times," and added, "We did not request an investigation at the informant's own discretion." PSPD also said it would be difficult for the complainant to speak with the media.
PSPD said it could not rule out the possibility that this case was secondary damage following the Coupang personal data leak in November last year. At the time, Coupang and the government said investigations found no leaks of sensitive information such as payment data or customs clearance numbers, but civic groups are calling for additional investigations and compensation for damages.
Earlier, on the 10th, the Ministry of Science and ICT issued a tentative announcement of the results of a joint public-private investigation into the Coupang incident and said there had been no secondary damage. Choi Woo-hyeok, director general for Information Security and Network Policy at the ministry, said, "So far there has been no leak of payment information, and there are no cases where leaked information was used for crimes." The government disclosed this after the PSPD reporting center's operating period (Dec. 4 last year to Jan. 4 this year).
Shortly after the PSPD announcement the previous day, Coupang issued a statement and reaffirmed, in line with previous findings, that no secondary damage such as leaks of payment information or passwords had been confirmed. It also said the possibility of crimes such as unauthorized use by a third party (computer use fraud) due to an information leak in the case referred by PSPD was low.
Coupang noted that the payment in question was a normal transaction made from the same device with an existing order history, and the delivery address was set to the complainant's home. It added that its customer center occasionally receives suspected unauthorized payment reports, but most turn out to be simple misunderstandings, such as a family member—often a minor child—making a purchase using a mobile phone.
It also emphasized that the payment was canceled immediately after the customer inquired, so no financial damage occurred. Coupang said, "We express strong regret that People's Solidarity for Participatory Democracy (PSPD) continues to make baseless claims and thereby stokes consumer anxiety."
PSPD explained that a payment cancellation is merely a post-crime measure and is separate from whether a crime was constituted. Citing past case law, it argued that even if the payment was canceled, if the act of unauthorized payment itself occurred, legal liability could be established.
However, both sides said it is difficult to conclude at this time, before a police investigation is underway, whether the payment was unauthorized or legitimate. PSPD said the matter is at the stage of requesting an investigation, not filing a complaint, and Coupang said it would wait for the results of any future investigation.