The Personal Information Protection Commission demanded that Coupang correct its notice from a "disclosure" of personal information to a "leak" and re-notify users. This came after it emerged that Coupang guided users as if it were a partial "disclosure" incident even after confirming a personal information leak affecting more than 30 million customers.
On the 3rd, the Personal Information Protection Commission said it held an emergency full meeting in the morning to review the response to Coupang's personal information leak and voted to "immediately carry out a re-notification of the personal information leak to prevent further damage." It also voted to demand that Coupang repost the notice on its homepage and provide guidance on how to prevent damage.
The Personal Information Protection Commission said, "Despite this being a leak incident at an e-commerce (electronic commerce) service used by the vast majority of the public, guidance on preventive measures that data subjects can take was insufficient," and noted, "Coupang's own response measures and procedures for relief were inadequate."
According to the Personal Information Protection Commission, Coupang not only downgraded its announcement of a leak of 33.7 million items of personal information to a disclosure, but also limited the related notice on its website to a short period of only one to two days. It also omitted in the notification the fact that some leaked items included information such as shared entrance door passwords.
The Personal Information Protection Commission plans to review the effectiveness of damage prevention measures and actively engage in monitoring Coupang's response itself. In particular, regarding the re-notification of the leak resolved on this day, it is understood that the commission informed Coupang to submit the results of its actions within seven days.
The Personal Information Protection Commission said, "We take seriously the gravity of the matter, in which the contact information and addresses of a large number of people were leaked," adding, "We will swiftly and thoroughly investigate the circumstances of Coupang's personal information leak, its scale and items, and violations of security obligations, and impose strict sanctions if violations are confirmed."