South Korea Moves to Tighten Data Laws After Coupang Breach

South Korea has intensified efforts to strengthen data protection rules after a major cyberattack on Coupang compromised the personal details of 33.7 million users. Prime Minister Lee Nak-yon urged lawmakers to impose tougher penalties on companies that fail to safeguard consumer data, stressing the need to maintain public trust in the nation’s rapidly expanding digital economy.

Major Breach Exposes Millions of User Accounts

Coupang detected the breach on November 18 and believes unauthorised access began in June through overseas servers. The compromised data includes basic personal information, though the company says payment details remain secure. Coupang apologised and advised customers to stay alert to potential phishing attempts.

Government Push for Stronger Penalties

Prime Minister Lee stated that companies must face stricter consequences for negligence in data protection. He highlighted that the digital economy depends heavily on trust and called for closer coordination among government agencies and private firms to prevent future incidents. His remarks have intensified debate around revising existing regulations.

Review of South Korea’s Data Privacy Framework

South Korea’s Personal Information Protection Act already ranks among the more robust data governance laws globally. Critics argue, however, that enforcement has often been inconsistent and penalties too lenient to deter violations. The scale of the Coupang breach has renewed demands for higher fines and stronger compliance mechanisms.

Exam Oriented Facts

• The Coupang breach affected 33.7 million customer accounts.
• Unauthorised access is believed to have begun on 24 June 2025.
• South Korea regulates data privacy under the Personal Information Protection Act.
• The incident surpasses the SK Telecom leak that impacted 23.2 million users.

Industry Response and Ongoing Investigations

Coupang has launched a detailed investigation with cybersecurity specialists and is cooperating with regulators and law enforcement. The company earlier reported a smaller leak involving 4,500 users in November. The latest episode has prompted broader scrutiny of data security standards across South Korea’s technology sector, raising expectations of imminent legislative reform.