SEOUL, November 06 (AJP) - A Seoul court on Thursday rejected e-commerce giant Coupang's request to suspend a record 423.6 billion won ($312 million) fine imposed over a massive personal data breach affecting approximately 37.5 million people, while temporarily halting separate corrective orders issued by South Korea's privacy watchdog.
The Seoul Administrative Court's Fourth Administrative Division partially granted Coupang's application for a stay of enforcement against the Personal Information Protection Commission (PIPC).
The court ruled that the financial penalty should remain in effect, finding insufficient evidence that its enforcement would cause irreparable harm to the company or that an urgent suspension was necessary.
It said any financial losses resulting from the penalty could potentially be recovered through monetary compensation, rejecting Coupang's argument that the fine should be suspended while its legal challenge proceeds.
However, the court agreed to temporarily suspend the regulator's corrective orders and public disclosure requirements, citing the possibility of irreparable harm to the company.
The suspension will remain in place until 30 days after the Seoul Administrative Court delivers its first-instance ruling in the main lawsuit.
The corrective measures include strengthening personal data security systems to prevent similar incidents, notifying affected individuals who were not registered Coupang members and ensuring that the company's chief privacy officer can exercise meaningful authority over data protection.
The court's decision does not determine whether the fine itself was legally justified. That question will be examined separately in Coupang's lawsuit seeking to overturn the regulator's sanctions.
No date has been set for the first hearing in the main proceedings.
Coupang said it would carefully review the court's decision before deciding how to respond.
The PIPC imposed the 423.6 billion won penalty in June after concluding that Coupang had failed to implement adequate security measures, resulting in one of the largest personal data breaches in South Korean history. The penalty was the largest ever imposed in the country for a single personal data breach.
The regulator separately fined Coupang approximately 201.1 billion won for collecting and storing the online activity records of about 11.17 million users on third-party websites and applications without obtaining proper consent. The two penalties brought the company's total fines to approximately 624.7 billion won.
The data breach first came to light in November 2025, when Coupang initially reported that personal information belonging to about 4,500 customers had been exposed. The company subsequently revised the figure to approximately 33.7 million accounts, triggering widespread public concern over its handling of sensitive customer information.
A government investigation later determined that a former Coupang employee had exploited weaknesses in the company's authentication system to gain unauthorized access to customer information between April and November 2025.
According to the PIPC, the former employee obtained an authentication signing key and generated forged authentication tokens, allowing access to customer account pages, delivery address records and order histories.
The regulator found that the incident compromised personal information belonging to approximately 33.22 million Coupang members and at least 4.33 million nonmembers, including family members, friends and other individuals whose contact details had been stored in delivery records.
The exposed information included names, email addresses, telephone numbers, delivery addresses and some purchase histories.
Investigators concluded that Coupang had failed to properly safeguard authentication keys and detect abnormal access patterns, allowing unauthorized access to continue for months before the breach was discovered.
Copyright ⓒ Aju Press All rights reserved.
