{
  "type": "NewsArticle",
  "url": "https://sonomos.ai/newsroom/coupang-court-refuses-suspend-423-billion-won-breach-fine/",
  "slug": "coupang-court-refuses-suspend-423-billion-won-breach-fine",
  "title": "Seoul court refuses to suspend Coupang's record 423.6 billion won breach fine but pauses its tracking fine",
  "summary": "A Seoul court kept Coupang's 423.6 billion won breach fine in force on November 5, then suspended a separate 201.1 billion won fine for collecting browsing records. Here is what each ruling changes.",
  "section": "Privacy",
  "category": "privacy",
  "format": "analysis",
  "tags": [
    "data breach",
    "South Korea",
    "PII",
    "GDPR"
  ],
  "published_at": "2026-11-08T14:12:00.000Z",
  "updated_at": "2026-11-08T14:12:00.000Z",
  "word_count": 777,
  "publisher": {
    "name": "Sonomos Newsroom",
    "url": "https://sonomos.ai/newsroom/",
    "standards": "https://sonomos.ai/newsroom/standards/",
    "organization": {
      "name": "Sonomos",
      "url": "https://sonomos.ai/"
    }
  },
  "follows_up": null,
  "followed_by": [],
  "sources": [
    {
      "number": 1,
      "title": "Court keeps Coupang's record data breach fine in force, but pauses corrective orders",
      "publisher": "Korea JoongAng Daily",
      "url": "https://www.koreajoongangdaily.com/business/court-keeps-coupangs-record-data-breach-fine-in-force/12958722",
      "published": "2026-11-05",
      "accessed": "2026-11-08"
    },
    {
      "number": 2,
      "title": "Court suspends $147.74 mil. fine imposed on Coupang for unauthorized user data collection",
      "publisher": "The Korea Times",
      "url": "https://www.koreatimes.co.kr/southkorea/law-crime/20261106/court-suspends-14774-mil-fine-imposed-on-coupang-for-unauthorized-user-data-collection",
      "published": "2026-11-06",
      "accessed": "2026-11-08"
    },
    {
      "number": 3,
      "title": "Coupang Sues Over 624.7 Billion Won Privacy Fines, Including Record Breach Penalty",
      "publisher": "Seoul Economic Daily",
      "url": "https://en.sedaily.com/society/2026/10/08/coupang-sues-regulator-over-record-6247-billion-won-privacy",
      "published": "2026-10-08",
      "accessed": "2026-11-08"
    },
    {
      "number": 4,
      "title": "South Korea issues Won624.68bn fine on Coupang over data breach",
      "publisher": "Retail Insight Network",
      "url": "https://www.retail-insight-network.com/news/south-korea-fines-coupang-won624-68bn/",
      "published": "2026-06-12",
      "accessed": "2026-11-08"
    },
    {
      "number": 5,
      "title": "Coupang Discloses Korean Fines to US SEC, Vows Legal Action",
      "publisher": "Seoul Economic Daily",
      "url": "https://en.sedaily.com/finance/2026/06/12/coupang-discloses-korean-fines-to-us-sec-vows-legal-action",
      "published": "2026-06-12",
      "accessed": "2026-11-08"
    }
  ],
  "verification": {
    "method": "automated-source-check",
    "checked_at": "2026-11-08T14:12:00.000Z",
    "description": "https://sonomos.ai/newsroom/standards/",
    "claims": [
      {
        "claim": "The Seoul Administrative Court rejected Coupang's request to suspend the 423.6 billion won breach fine on November 5, 2026.",
        "source": 1,
        "source_url": "https://www.koreajoongangdaily.com/business/court-keeps-coupangs-record-data-breach-fine-in-force/12958722"
      },
      {
        "claim": "The court suspended enforcement of the corrective orders and public-disclosure orders until 30 days after a ruling in the main lawsuit.",
        "source": 1,
        "source_url": "https://www.koreajoongangdaily.com/business/court-keeps-coupangs-record-data-breach-fine-in-force/12958722"
      },
      {
        "claim": "A different panel suspended the 201.1 billion won fine over browsing records of about 11.17 million users on November 6.",
        "source": 2,
        "source_url": "https://www.koreatimes.co.kr/southkorea/law-crime/20261106/court-suspends-14774-mil-fine-imposed-on-coupang-for-unauthorized-user-data-collection"
      },
      {
        "claim": "Coupang filed two suits at the Seoul Administrative Court seeking cancellation of the fines and also requested stays of execution.",
        "source": 3,
        "source_url": "https://en.sedaily.com/society/2026/10/08/coupang-sues-regulator-over-record-6247-billion-won-privacy"
      },
      {
        "claim": "The PIPC found a former employee extracted data on 33,222,472 members and 4,338,368 non-members.",
        "source": 5,
        "source_url": "https://en.sedaily.com/finance/2026/06/12/coupang-discloses-korean-fines-to-us-sec-vows-legal-action"
      }
    ]
  },
  "corrections": [],
  "body_markdown": "A Seoul court has left the largest personal-data breach fine in South Korean history in force while pausing a second, separate penalty against the same company. The Seoul Administrative Court [rejected Coupang's request to suspend a 423.6 billion won fine](https://www.koreajoongangdaily.com/business/court-keeps-coupangs-record-data-breach-fine-in-force/12958722) on Thursday, November 5, 2026, according to Korea JoongAng Daily, and the next day a different panel [suspended a 201.1 billion won fine](https://www.koreatimes.co.kr/southkorea/law-crime/20261106/court-suspends-14774-mil-fine-imposed-on-coupang-for-unauthorized-user-data-collection) for collecting users' browsing records, The Korea Times reported.\n\nBoth rulings are interim decisions on requests to stop enforcement. The lawsuits that decide whether the fines stand are still pending.\n\n## What did the court decide on each fine?\n\nThe Personal Information Protection Commission (PIPC) imposed both fines in June. The two rulings went in opposite directions:\n\n| Measure | Amount | What it covers | Court's interim ruling |\n|---|---|---|---|\n| Data breach fine | 423.6 billion won | Inadequate security; about 37.5 million users affected | Suspension refused (Nov. 5): fine stays in force |\n| Corrective and public-disclosure orders | n/a | Stronger security, notice to non-members, privacy officer's role | Enforcement suspended (Nov. 5) |\n| Browsing-records fine | 201.1 billion won | Collecting activity records of about 11.17 million users without consent | Enforcement suspended (Nov. 6) |\n\nOn the breach fine, the court found no grounds for a suspension, per [JoongAng Daily](https://www.koreajoongangdaily.com/business/court-keeps-coupangs-record-data-breach-fine-in-force/12958722). It did suspend the corrective orders and the orders requiring public disclosure, saying they could cause \"irreparable harm\" to Coupang. That suspension lasts until 30 days after a ruling in the main lawsuit. The corrective orders require Coupang to strengthen security measures, notify affected people who are not members, and make sure its chief privacy officer can do the job effectively.\n\nOn the browsing-records fine, the court cited the risk of irrecoverable damage and suspended enforcement until 30 days after the first verdict in the main lawsuit, [The Korea Times reported](https://www.koreatimes.co.kr/southkorea/law-crime/20261106/court-suspends-14774-mil-fine-imposed-on-coupang-for-unauthorized-user-data-collection). Neither report gives a verdict date or a first hearing date.\n\n## What did the regulator find?\n\nAccording to [Retail Insight Network](https://www.retail-insight-network.com/news/south-korea-fines-coupang-won624-68bn/), the PIPC fined Coupang a total of 624.68 billion won, plus a separate 16.8 million won administrative fine, and ordered corrective and publication measures. The exposed data included names, email addresses, phone numbers and home addresses of about 37.55 million users. Investigators blamed weaknesses in security practice, including poor handling of authentication signing keys and insufficient access controls, rather than a sophisticated attack.\n\n[Seoul Economic Daily](https://en.sedaily.com/finance/2026/06/12/coupang-discloses-korean-fines-to-us-sec-vows-legal-action) reported that the PIPC found a former employee had extracted data on 33,222,472 members and 4,338,368 non-members, and cited a token-based authentication flaw that Coupang allegedly failed to fix. A later [Seoul Economic Daily report](https://en.sedaily.com/society/2026/10/08/coupang-sues-regulator-over-record-6247-billion-won-privacy) says the PIPC also cited failure to detect numerous anomalies and the manual deletion of about five months of web access logs after an order to preserve evidence.\n\n## What happens next in the lawsuits?\n\nCoupang filed two suits against the PIPC at the Seoul Administrative Court in October, each seeking cancellation of one fine, and asked for a stay of execution of each penalty, per the [October report](https://en.sedaily.com/society/2026/10/08/coupang-sues-regulator-over-record-6247-billion-won-privacy). Coupang said it regretted that its preventive steps and fact-based explanations were not sufficiently reflected in the decision, and that it expects the facts to be clarified through legal proceedings.\n\nThe stay requests have now been answered once each: refused for the breach fine, granted for the tracking fine and the corrective orders. Because the suspensions run until 30 days after a ruling in each main case, Coupang's tracking fine and the corrective orders cannot be enforced while those cases proceed, but the breach fine can.\n\n## Why does this matter beyond Korea?\n\nThe case turns on two fact patterns that regulators elsewhere also treat as separate violations: how a company secures access to personal data, and whether it collected activity records without consent. Our earlier coverage of [South Africa's fine against FNB over exposed home loan data](https://sonomos.ai/newsroom/south-africa-regulator-fines-fnb-r1-million-popia-home-loan-platform/) involved the first pattern at a far smaller scale. The data at issue, names, contact details and addresses, is the kind the glossary defines as [personally identifiable information](https://sonomos.ai/glossary/personally-identifiable-information/), and the same categories fall under the [GDPR](https://sonomos.ai/glossary/gdpr/) in Europe.\n\nFor readers tracking how personal data leaves organisations, the PIPC's finding that access controls and key handling failed, not that an outside attacker defeated advanced defences, matches the routes described in [seven ways sensitive information escapes to language models](https://sonomos.ai/blog/ai-data-leakage-7-ways-sensitive-info-escapes-to-llms/).\n\n## What is still unresolved?\n\n- No hearing date has been set for the main lawsuits, per JoongAng Daily.\n- The reports reviewed do not name the specific statutory provisions behind the fines; Seoul Economic Daily says only that the PIPC found violations of the Personal Information Protection Act in the advertising-programme matter.\n- The reports do not say what the collected browsing records contained.\n- Whether the courts will uphold, reduce or cancel either fine is not known.",
  "links": {
    "html": "https://sonomos.ai/newsroom/coupang-court-refuses-suspend-423-billion-won-breach-fine/",
    "markdown": "https://sonomos.ai/newsroom/coupang-court-refuses-suspend-423-billion-won-breach-fine/index.md",
    "json": "https://sonomos.ai/newsroom/coupang-court-refuses-suspend-423-billion-won-breach-fine/index.json",
    "image": "https://sonomos.ai/og/newsroom/coupang-court-refuses-suspend-423-billion-won-breach-fine.png"
  }
}