SEOUL, July 31 (AJP) - South Korea's consumer watchdog on Friday ordered e-commerce giant Coupang to compensate victims of last year's massive data breach, marking the first decision to recognize the company's liability for damages resulting from the leak.
The Consumer Dispute Settlement Commission under the Korea Consumer Agency said Coupang should pay 100,000 won (US$70) in compensation to each of the 50 consumers who filed a collective action in December last year over the breach, which exposed the sensitive personal information of tens of millions of users.
They may choose to receive the compensation in cash or as a voucher that can be used on Coupang's website or mobile app.
The commission said the breach exposed not only users' personal information including their names, email addresses and home addresses, but also highly sensitive data closely linked to their private lives such as order histories.
It added that a hacker had stolen personal data over an extended period and that there was a risk the information could be misused, citing disguised emails sent to some customers in connection with the leak.
Coupang argued that it had retrieved the device used in the breach and that there was no risk of further damage. However, the commission said it was difficult to say that the possibility of additional leaks had been completely ruled out. It also found that Coupang should compensate users for emotional distress caused by the breach.
The commission said the amount was set at 100,000 won, taking into account the level of compensation courts have typically recognized in large-scale data leak cases and the sensitivity of the leaked information. It also considered the fact that Coupang had not disclosed how many affected users had actually used the 50,000-won shopping vouchers it issued in January as compensation.
Coupang must notify the commission within 15 days of receiving the written decision whether it will accept Friday's decision. If it does not respond within the period, it will be considered to have accepted it.
The commission will also take follow-up measures including requiring a compensation plan to ensure that the same payments are made to those who did not join the class action.
Coupang suffered a massive data breach in November last year, in which about 37.56 million cases of personal information were leaked. The government last month imposed a record fine of 62.47 million won, along with an additional penalty of 16.8 million won.
The Consumer Dispute Settlement Commission under the Korea Consumer Agency said Coupang should pay 100,000 won (US$70) in compensation to each of the 50 consumers who filed a collective action in December last year over the breach, which exposed the sensitive personal information of tens of millions of users.
They may choose to receive the compensation in cash or as a voucher that can be used on Coupang's website or mobile app.
The commission said the breach exposed not only users' personal information including their names, email addresses and home addresses, but also highly sensitive data closely linked to their private lives such as order histories.
It added that a hacker had stolen personal data over an extended period and that there was a risk the information could be misused, citing disguised emails sent to some customers in connection with the leak.
Coupang argued that it had retrieved the device used in the breach and that there was no risk of further damage. However, the commission said it was difficult to say that the possibility of additional leaks had been completely ruled out. It also found that Coupang should compensate users for emotional distress caused by the breach.
The commission said the amount was set at 100,000 won, taking into account the level of compensation courts have typically recognized in large-scale data leak cases and the sensitivity of the leaked information. It also considered the fact that Coupang had not disclosed how many affected users had actually used the 50,000-won shopping vouchers it issued in January as compensation.
Coupang must notify the commission within 15 days of receiving the written decision whether it will accept Friday's decision. If it does not respond within the period, it will be considered to have accepted it.
The commission will also take follow-up measures including requiring a compensation plan to ensure that the same payments are made to those who did not join the class action.
Coupang suffered a massive data breach in November last year, in which about 37.56 million cases of personal information were leaked. The government last month imposed a record fine of 62.47 million won, along with an additional penalty of 16.8 million won.
Copyright ⓒ Aju Press All rights reserved.