Record penalty threatens to push Coupang to a loss for a second straight quarter; revenue-linked fine system means smaller firms pay far less
South Korea's Personal Information Protection Commission hit Coupang Inc with a record fine exceeding 600 billion won — roughly equal to the company's entire operating profit for last year — throwing its profitability and investment plans into jeopardy.
The commission imposed a total fine of approximately 624.7 billion won on Thursday over a personal data breach. It assigned about 423.6 billion won to the data leak itself and an additional 201.1 billion won for unauthorized collection of members' online activity and other violations.
The penalty is the largest ever imposed for a single personal data breach in South Korea, and also the largest total fine ever levied against one company for multiple violations. It is more than four times the previous record of approximately 134.7 billion won set by SK Telecom. Coupang's parent, Coupang Inc, reported full-year operating profit of 679 billion won ($473 million) last year — meaning the fine is roughly equivalent to every won the company earned in a year.
Coupang had already posted an operating loss of 354.5 billion won in the first quarter, hurt by the fallout from the data breach and the cost of issuing customer compensation vouchers. The company said it would contest the fine through legal channels. Because a fine is recorded as a loss in the quarter in which it is imposed, however, Coupang is expected to post another operating loss in the second quarter. The company turned its first quarterly operating profit in the third quarter of 2022 and had since been generating between 100 billion and 200 billion won in operating profit per quarter.
Coupang has been building logistics centers across the country — including in Busan and Jecheon — as part of its push to extend its Rocket Delivery service nationwide by next year. The record fine has raised concerns that a sharp deterioration in profitability could force the company to scale back investment and hiring. Coupang currently employs about 90,000 people across 100 logistics centers in 30 regions nationwide. The data breach triggered a wave of customer cancellations that pushed the workforce below 90,000 in February before it began recovering.
The size of the fine stems from South Korea's Personal Information Protection Act, which ties penalties to revenue. Under the system, fines are calculated as a percentage of revenue directly related to the violation, with the rate varying by severity: up to 3 percent for the most serious breaches, 1.5 to 2.1 percent for serious violations, and 0.9 to 1.5 percent for ordinary violations.
The revenue-linked structure means smaller companies pay far less even when they expose highly sensitive data. Marriage matchmaking firm Duo, for instance, was fined just 1.2 billion won (about $788,000) after a hack of employee computers exposed sensitive personal information — including height, weight, religion, marital history and education — of roughly 420,000 members. The relatively modest penalty reflected Duo's smaller revenue and its classification as a mid-sized company.
Even against fellow large conglomerate SK Telecom, Coupang's fine stands out. The commission earlier fined SK Telecom 134.8 billion won over the SIM card hacking incident. SK Telecom's annual revenue stands at about 17 trillion won while Coupang's South Korean unit posts roughly 45.5 trillion won, meaning Coupang's fine represents a higher share of revenue than the penalty imposed on SK Telecom.
korean@heraldcorp.com
