South Korea's Personal Information Protection Commission levied a record Won624.6bn ($409mn) fine against Coupang, the country's largest online retailer, following a data breach that compromised nearly two-thirds of South Korea's population. The penalty marks the largest single-company data breach fine in South Korean history, split between breach damages and unauthorized data collection violations.

The breach, which began in April through Coupang's overseas servers, went undetected until November when authorities discovered a former employee had accessed customer information using an active private encryption key. Coupang's delayed response sparked public outrage and led to the resignation of its South Korean subsidiary's chief executive. The company expressed regret that its post-breach measures weren't adequately considered in the commission's decision.

Market impact appears significant. Coupang reported a $242mn operating loss in the first quarter and warned of slower revenue growth as security concerns drive customers away. With 25 million active members and being the nation's largest private-sector employer after Samsung, the e-commerce giant faces both reputational damage and financial strain. The diplomatic dimension adds complexity, as US investors previously petitioned under Section 301, though they later withdrew the complaint.

This case illustrates growing tensions between national data protection laws and international business operations. South Korean officials maintain they're not discriminating against US companies, but the unprecedented fine amount raises questions about regulatory consistency and could complicate future US-Korea tech cooperation.