Experts said Coupang released its own investigation results based on the suspect's statements and secured evidence regarding the personal information leak case in an apparent bid to lower the scale of damages in class-action lawsuits and the level of disciplinary action such as a penalty surcharge.
Some also said that because Coupang directly took the suspect's statements, issues such as "coordination of stories" could become points of contention. By unilaterally making public its own investigation results without consulting the government, the scope and range of those surveyed by the public-private joint investigation team could be expanded.
According to legal sources on the 26th, the core of the self-investigation results that Coupang released the previous day can be summarized in four points: ① The former employee (suspect) who leaked personal information accessed 33 million customer account information, but stored 3,000 of them, which is relatively small; ② all stored information was deleted and not provided to others; ③ the suspect acted alone; ④ Coupang has submitted all secured written statements and evidence to the government and is cooperating.
If all of Coupang's investigation results are true, the company could reduce damages in large-scale class-action suits sparked by the personal information leak. In personal information leak damage suits, it is usually difficult to prove actual damages (active damages) or lost profits that could have been earned in the future (passive damages), so the disputes typically center on mental damages.
Regarding mental damages, it is first important whether the leaked personal information makes it possible to identify the data subject and whether a third party has viewed or could view the leaked personal information going forward. The amount of damages can vary greatly depending on what personal information was spread and how far it spread.
Coupang said the customer personal information the suspect accessed was limited to "name, email, address, and phone number," and that there was no access to "payment information, login-related information, or personal customs clearance numbers." Coupang also said the suspect stated that about 3,000 items were stored after accessing order information, and that a digital forensics review by an external specialist firm matched the statement. Coupang claims these information items were likewise not leaked to any third party.
More than 400,000 people have joined class-action suits against Coupang represented by three law firms—Illo, Jihyang, and Beonhwa—alone. However, based on this internal investigation, Coupang has secured grounds to argue that the number of people who suffered actual harm is about 3,000.
There is also an analysis that by actively undertaking the investigation and emphasizing that the suspect acted alone, Coupang sought to stress the absence of intent or gross negligence.
The Supreme Court recently upheld a lower court ruling that a website had no liability to compensate its members for damages in a 2021 personal information hacking case. While only encrypted email information and the like were leaked, the court found it difficult to deem intent or gross negligence given that the site reported the incident to the Personal Information Protection Commission and police immediately upon recognizing it and took measures to prevent the occurrence and spread of harm.
A lawyer who previously served as a chief prosecutor said, "Coupang's self-investigation results emphasize that the scope of damage is not large and that it worked to prevent secondary harm," adding, "It appears to have considered not only class-action suits and a penalty surcharge but also hearings that politicians have recently been speeding up."
However, there is a view that Coupang's internal investigation could instead exacerbate the issue. The credibility of the suspect's statements is expected to come under scrutiny immediately.
Ha Hee-bong, an attorney at LOPID Law Office representing the Coupang personal information leak class-action suits, said, "As Coupang directly contacted the personal information leaker and secured evidence, there is now a possibility the statements and evidence were tainted," adding, "Other class-action representatives and even investigative authorities have little choice but to suspect that Coupang moved to cover up wrongdoing."
For Coupang, only if the suspect's criminal acts are narrowed can it reduce its compensation exposure. Legal sources consistently assessed that the very act of contacting the suspect at will under the pretext of investigation—whose interests overlap—is an inappropriate response.
There is also an opinion that Coupang's release of the internal investigation results could work against the company in terms of the penalty surcharge imposed by the Personal Information Protection Commission (PIPC).
Ko Hak-soo, former chair of the PIPC, said on his social media (SNS), "Penalty surcharges are determined based on the notice 'Standards for Imposition of Penalty Surcharges for Violations of the Personal Information Protection Act,' and there is no particular provision to take external leakage into account," adding, "By contrast, whether there is cooperation with the PIPC is an explicit reason for aggravation (or mitigation)." He then said, "Considering the notice, Coupang's release seems more likely to work to raise the penalty surcharge rather than lower it."
To have a penalty surcharge mitigated, cooperation with the PIPC is important, but with the government protesting that Coupang's announcement of its internal investigation results was unilateral, there is a strong chance it will be deemed "uncooperative."
Coupang argued that this probe was not a "self-investigation," but was conducted under the government's instructions. Coupang explained, "For weeks, Coupang has worked with the government almost daily to track and contact the leaker and communicate," adding, "Under the government's instructions, we first retrieved the information leaker's desktop and hard disk drive and reported and provided them to the government."
Coupang went on to say, "While fully cooperating with the ongoing government investigation, we will take all necessary measures to prevent secondary harm."