In the process of calculating the 12.836 billion won penalty surcharge imposed on GS Retail(007070) on the 31st, it turned out that franchise supply sales—accounting for more than 70% of the company's total revenue—were excluded from the basis for the penalty surcharge calculation. In contrast with the record 624.681 billion won imposed on Coupang three months earlier, this confirms that the severity of sanctions can vary widely depending on a retailer's revenue structure.
The action stems from an incident in which GS Retail's GS SHOP and GS25 websites were hit by a hacker's indiscriminate login attacks from June 2024 to February this year, leaking the names, contact information and addresses of 1,661,53 members.
According to the industry on the 2nd, the Personal Information Protection Commission excluded about 8 trillion won in revenue—booked when headquarters supplies goods to franchisees—from the roughly 11.5 trillion won average revenue over GS Retail's previous three fiscal years, viewing it as revenue unrelated to the violation. The judgment was that, as business-to-business (B2B) transactions, they are not directly related to the personal data leak. As a result, the revenue used as the basis for calculating the penalty surcharge shrank to the 2 trillion won range.
Under the Personal Information Protection Act, a penalty surcharge is calculated based on the total revenue minus revenue unrelated to the violation, and cannot exceed 3% of total revenue. The business operator must directly prove the unrelated revenue. GS Retail's business report shows revenue of 11.0803 trillion won in 2023, 11.5794 trillion won in 2024 and 11.9574 trillion won in 2025.
The final sticking point was whether to include revenue from the GS The Fresh supermarket, according to accounts. GS Retail uses a unified database (DB) across home shopping, convenience stores and supermarkets, but this attack occurred only at GS SHOP and GS25. Because the DB is shared, some argued supermarket revenue should be included, while others countered that a division not actually attacked cannot be added; in the end, supermarket revenue was left out of the basis.
The attack method is also seen as having determined the outcome. In this incident, the hacker used "credential stuffing," repeatedly trying IDs and passwords obtained externally. With login-gated websites as targets, only GS SHOP and GS25 were breached. The internal view at the commission was that if the unified DB server had been directly attacked, revenue for the entire business, including supermarkets, could have been included in the basis. For that reason, during deliberations, views were raised that the calculation basis could vary depending on future revenue recognition structures, attack points, and the scale and types of leaked data. It also means that even if the same type of incident recurs at the same company, there is no guarantee franchise supply revenue would be excluded again.
The retail industry says the outcome stands in sharp contrast with the Coupang case three months earlier. In June, the Personal Information Protection Commission imposed a total penalty surcharge of 624.681 billion won on Coupang, including 423.575 billion won related to the leak and 201.106 billion won for infringements such as unauthorized collection of other firms' online activity records. At the time, the commission used revenue from Coupang's e-commerce service, where the incident occurred, as the basis for the penalty surcharge, excluding only divisions notified as separate services such as Coupang Eats and Coupang Play.
During the deliberations, Coupang argued that it directly buys products from manufacturing small and midsize enterprises, leaving almost no margin, and that the entire transaction amount was overcounted as its own revenue, but the claim was not accepted in the end. Coupang has signaled an administrative lawsuit challenging the action.