Regulators fined Coupang for basic safeguards, and a Seoul court has now left the record penalty in force.
Regulators fined Coupang for basic safeguards, and a Seoul court has now left the record penalty in force.
A Seoul court has refused to suspend the roughly US$319 million (423.6 billion won) fine that South Korea's privacy regulator imposed on Coupang over a breach affecting about 37.5 million users. All dollar figures here use the November 9 mid-market rate of about 1,326 won to the US dollar, according to Wise. The Korea JoongAng Daily reported the ruling on November 5. It's the largest fine ever imposed in Korea for a single personal data breach.
The regulator's finding centered on fundamentals. The Korea Herald reports that the Personal Information Protection Commission blamed the leak on missing basic safeguards, from managing authentication signing keys to controlling system access. Most security leaders have an access policy on paper. The open question is what a valid credential is doing in your data on any given day.
What did South Korea's regulator find in the Coupang breach?
The commission announced its penalties in June. The Korea Herald reports a combined penalty of about US$471 million (624.9 billion won), with about US$319 million (423.6 billion won) for the leak itself and about US$152 million (201.1 billion won) for other privacy violations. Investigators counted 33.22 million members and at least 4.33 million nonmembers among the victims.
According to The Next Web, citing Al Jazeera, a former employee took a cryptographic signing key and used it to reach customer data from overseas servers. The intrusion ran undetected for nearly five months. The exposed data included names, email addresses, phone numbers, shipping addresses and order histories.
Why does the November court ruling matter to security leaders?
The Seoul Administrative Court declined to suspend the fine because, as SBS News reports, it judged that any damage to Coupang appeared restorable through monetary compensation. The court did pause the corrective orders until 30 days after the main lawsuit is decided. Those orders require stronger security measures, notifying affected people who aren't Coupang members and making sure the chief privacy officer can do the job, according to the Korea JoongAng Daily. A separate panel suspended the roughly US$152 million (201.1 billion won) fine over tracking members' activity on outside sites. No hearing date has been set for the main case.
A regulator treated missing basic safeguards as the violation. The fine stays payable while the appeal proceeds.
Do North American regulators enforce the same safeguards?
Korea's penalties run larger than most North American settlements, but the failure pattern looks familiar. On November 6 the New York Attorney General announced a settlement of up to $10 million with Perry Johnson & Associates over a breach affecting 13.3 million people. The investigation found that hackers used an employee's credentials, that remote access didn't require multi-factor authentication and that monitoring software recorded the activity without alerting security staff. The company learned of it two months later, when the hackers contacted it. The same press release lists recent New York settlements from $2.3 million to $18 million.
In Canada, Quebec's Law 25 makes failing to take reasonable security measures an offence. Osler reports that penal fines can reach the greater of C$25 million or 4% of worldwide turnover.
What should security teams ask after the Coupang fine?
Three questions are worth asking this week:
- When someone leaves, can you see every credential and key that still reaches your sensitive data?
- Would you notice a valid credential reading customer data at an unusual volume or from an unusual place?
- Can you show a regulator who touched what and when?
How does MIND show who is touching sensitive data?
Key management belongs to your identity program. No data security platform replaces it. MIND minds what happens to the data once a credential is in use.
Discovery builds a catalog of resources, users, file activities and metadata. Detection is context-aware and risk-based, so it surfaces what matters rather than everything. Identity and data work together, which means controls understand who is touching what. Adaptive controls can block, add a speed bump, coach or monitor based on risk severity.
“When an alert comes from MIND, we know for a fact it's worth following up on. That's hugely valuable.”
Richard Reinders
VP of Information Security, Gravity Payments
Can you show who touched your sensitive data last month?
Stress-Free DLP starts with seeing your data clearly. MIND deploys in minutes and delivers insights within 24 hours. Book a demo and see who is touching your sensitive data in your environment.
