Seoul court refuses to suspend Coupang's record 423.6 billion won breach fine but pauses its tracking fine

A Seoul court has left the largest personal-data breach fine in South Korean history in force while pausing a second, separate penalty against the same company. The Seoul Administrative Court rejected Coupang's request to suspend a 423.6 billion won fine on Thursday, November 5, 2026, according to Korea JoongAng Daily, and the next day a different panel suspended a 201.1 billion won fine for collecting users' browsing records, The Korea Times reported.

Both rulings are interim decisions on requests to stop enforcement. The lawsuits that decide whether the fines stand are still pending.

What did the court decide on each fine?

The Personal Information Protection Commission (PIPC) imposed both fines in June. The two rulings went in opposite directions:

On the breach fine, the court found no grounds for a suspension, per JoongAng Daily. It did suspend the corrective orders and the orders requiring public disclosure, saying they could cause "irreparable harm" to Coupang. That suspension lasts until 30 days after a ruling in the main lawsuit. The corrective orders require Coupang to strengthen security measures, notify affected people who are not members, and make sure its chief privacy officer can do the job effectively.

On the browsing-records fine, the court cited the risk of irrecoverable damage and suspended enforcement until 30 days after the first verdict in the main lawsuit, The Korea Times reported. Neither report gives a verdict date or a first hearing date.

What did the regulator find?

According to Retail Insight Network, the PIPC fined Coupang a total of 624.68 billion won, plus a separate 16.8 million won administrative fine, and ordered corrective and publication measures. The exposed data included names, email addresses, phone numbers and home addresses of about 37.55 million users. Investigators blamed weaknesses in security practice, including poor handling of authentication signing keys and insufficient access controls, rather than a sophisticated attack.

Seoul Economic Daily reported that the PIPC found a former employee had extracted data on 33,222,472 members and 4,338,368 non-members, and cited a token-based authentication flaw that Coupang allegedly failed to fix. A later Seoul Economic Daily report says the PIPC also cited failure to detect numerous anomalies and the manual deletion of about five months of web access logs after an order to preserve evidence.

What happens next in the lawsuits?

Coupang filed two suits against the PIPC at the Seoul Administrative Court in October, each seeking cancellation of one fine, and asked for a stay of execution of each penalty, per the October report. Coupang said it regretted that its preventive steps and fact-based explanations were not sufficiently reflected in the decision, and that it expects the facts to be clarified through legal proceedings.

The stay requests have now been answered once each: refused for the breach fine, granted for the tracking fine and the corrective orders. Because the suspensions run until 30 days after a ruling in each main case, Coupang's tracking fine and the corrective orders cannot be enforced while those cases proceed, but the breach fine can.

Why does this matter beyond Korea?

The case turns on two fact patterns that regulators elsewhere also treat as separate violations: how a company secures access to personal data, and whether it collected activity records without consent. Our earlier coverage of South Africa's fine against FNB over exposed home loan data involved the first pattern at a far smaller scale. The data at issue, names, contact details and addresses, is the kind the glossary defines as personally identifiable information, and the same categories fall under the GDPR in Europe.

For readers tracking how personal data leaves organisations, the PIPC's finding that access controls and key handling failed, not that an outside attacker defeated advanced defences, matches the routes described in seven ways sensitive information escapes to language models.

What is still unresolved?

• No hearing date has been set for the main lawsuits, per JoongAng Daily.
• The reports reviewed do not name the specific statutory provisions behind the fines; Seoul Economic Daily says only that the PIPC found violations of the Personal Information Protection Act in the advertising-programme matter.
• The reports do not say what the collected browsing records contained.
• Whether the courts will uphold, reduce or cancel either fine is not known.