With regard to the Coupang personal information leak case, law firm Jihyang, which is handling a class-action lawsuit, on the 7th asked the Korea Fair Trade Commission to order a halt to the distribution of compensation coupons totaling aggregates 50,000 won in value that Coupang has proposed, saying the plan could mislead consumers.
Jihyang said the compensation procedure, under which Coupang plans to begin issuing purchase coupons worth 50,000 won on the 15th, could constitute a "deceptive transaction act" prohibited by Article 21, Paragraph 1, Subparagraph 1 of the Electronic Commerce Act.
Jihyang also emphasized that since Dec. 25 last year, Coupang has been downplaying the scale of damage from the personal information leak through notices. At the time, Coupang posted a notice to the effect that "the leaker stored only about information from 3,000 accounts, and all of that information has been deleted, so there is virtually no leaked information," but this is not true.
Jihyang cited the blackmail email the personal information thief sent to Coupang. According to Jihyang, the email specified concrete theft volumes such as "more than 33 million email addresses" and "more than 120 million delivery addresses," and included an analysis of classification by email domain and distribution by basic local government of the delivery addresses. Jihyang explained, "Such analysis is technically impossible without actually possessing the data."
Jihyang also noted, "The fact that the leaker accessed personal information means the information was transmitted to and stored on the attacker's device," adding, "Coupang's claim that only 3,000 items were stored despite access to information on 33.7 million people does not accord with technical common sense."
Jihyang said it also asked the Personal Information Protection Commission to reissue the corrective order it handed down to Coupang on Dec. 3 last year. At the time, the commission ordered Coupang to revise the term "exposure of personal information" to "leak" and resend notifications; to inform victims whose names appeared on delivery address lists of the leak; and to actively guide concrete prevention measures such as changing communal entrance passwords.
Attorney Lee Eun-woo of Jihyang said, "After an information leak, what corporations must do is minimize damage and disclose information transparently, but Coupang is instead throwing victims into confusion and preventing an adequate response, exposing them to the risk of secondary harm," adding, "Swift and decisive action by the supervisory authorities is needed."