Coupang confirms lawsuits challenging South Korean privacy penalties

Coupang confirmed on October 8 that it had filed two administrative lawsuits challenging South Korean government privacy fines, bringing penalties reported by Reuters as 620 billion won ($462.75 million) into court. The US-listed e-commerce company’s challenge follows sanctions imposed in June; its earlier disclosures said an appeal would not automatically suspend payment.

The company confirmed the lawsuits in a text message to Reuters. The report establishes that proceedings have been filed, but does not give their precise filing dates, case numbers or detailed legal grounds. October 8 is the date of that confirmation, rather than a verified date for submission of the complaints.

What South Korea’s privacy regulator penalised

The Personal Information Protection Commission, or PIPC, adopted the sanctions on June 10. Its published account specified 624.681 billion won in penalties: 423.575 billion won for failures in security safeguards and 201.106 billion won for unlawful collection of behavioural data. Those were separate findings, rather than a single penalty solely for the breach.

The regulator’s exact total differs from Reuters’ rounded 620 billion won description. Reuters’ $462.75 million figure is the conversion reported in its October account. It should not be read as a fresh valuation of the exact regulatory total, or as evidence that the underlying won-denominated penalties increased.

Third-party records included telephone numbers, addresses, order information and building-access passwords, the PIPC said. It attributed the breach to inadequate basic safeguards, saying a former employee used forged authentication tokens to access systems between April and November 2025. These are the regulator’s findings, not findings by a court hearing the challenges.

The separate advertising-data finding concerned about 11.17 million users. The PIPC said behavioural information had been collected on external websites and applications without consent or notification. Coupang’s June disclosure likewise distinguished the November 2025 data incident from the third-party advertising matter.

Corrective orders extend beyond the fines

The PIPC also imposed a separate 16.8 million won fine, together with corrective and publication orders. Its corrective measures covered authentication security, access controls, notifications to nonmembers, privacy governance and making it easier to withdraw marketing consent. The October confirmation does not establish whether those measures have been completed.

How Coupang recorded the financial impact

In its June Form 8-K, Coupang described the breach-related penalty as approximately $278 million and the advertising-data penalty as approximately $132 million. Those were the company’s dollar estimates at that time, distinct from the conversion in Reuters’ October report.

Coupang subsequently reported a $410 million accrual for the PIPC administrative fines in second-quarter operating, general and administrative expenses. Recording that expense establishes its accounting treatment; it does not establish that the company paid the money.

The quarterly filing reported revenue of $8.856 billion, compared with $8.524 billion a year earlier. Operating, general and administrative expenses were $3.050 billion, up from $2.412 billion. The operating result moved from a $149 million profit to a $556 million loss.

The $410 million fine expense was therefore a substantial part of the quarter’s costs. The figures do not, however, support attributing the entire deterioration in operating performance to the privacy penalties.

What the lawsuits establish about payment

Coupang had signalled its intended challenge in June, stating: “Coupang Corp. will vigorously pursue judicial relief in the Seoul Administrative Court.” The October confirmation establishes that lawsuits followed that announcement. It does not establish a hearing date, a judicial timetable or an outcome.

The company’s June filing said payments to the PIPC are not automatically stayed during an appeal and that the fines are not deductible for income-tax purposes. It also warned that judicial review could take time and that the outcome was uncertain.

Reuters’ October report supplies no court order suspending payment, payment schedule or confirmation that payment has been completed. The confirmed development is the legal challenge; whether a court will change the penalties remains unresolved.