The PIPC said the decision was made at a June 10 plenary meeting and also included 16.8 million won in administrative penalties, corrective orders, publication measures and publication orders. In South Korean regulatory usage, an administrative fine is a financial sanction imposed by a regulator for statutory violations; it is separate from any criminal prosecution or civil damages.
The regulator said it concluded that about 37.55 million people's personal data was leaked because Coupang failed to manage authentication signing keys and access controls adequately. The PIPC said the leak affected 33,222,472 members and at least 4,338,368 non-members, including names, email addresses and other personal information, according to its release and Yonhap's account of the briefing.
Table: Main figures in the PIPC Coupang decision
| Finding | Figure or order | Source |
|---|---|---|
| Total Coupang administrative fines | 624.681 billion won | PIPC |
| Data-breach fine | 423.575 billion won | PIPC / Korean press reports |
| Unlawful online activity-record collection fine | 201.106 billion won | PIPC / Korean press reports |
| Administrative penalties | 16.8 million won | PIPC |
| People whose personal data was found leaked | About 37.55 million | PIPC |
| Users whose third-party online activity records were collected | About 11.17 million | PIPC |
Source: Personal Information Protection Commission release, 11 June 2026.
The PIPC said Coupang also collected and stored online activity records from about 11.17 million members who accessed third-party websites or apps where Coupang advertisements appeared. The regulator described those records as including visited URLs or app names, access times and IP addresses, and said the data could create risks for data subjects because it may reveal sensitive inferences about a person's interests or activities.
The decision also covered Coupang Fulfillment Service, a Coupang affiliate. The PIPC said it found violations involving collection and use of personal information and restrictions on processing sensitive information, including a police press-corps list and employee weight information. The regulator said it imposed 248 million won in administrative fines on the affiliate.