Coupang told to pay data breach damages in first compensation ruling

Coupang should pay each of 50 consumers 100,000 won ($69) in cash or the same amount in Coupang Cash over last year’s personal data breach, a consumer dispute mediation panel ruled Friday. This is the first decision to recognize the company’s liability for damages in the case.

“Coupang has the responsibility to compensate consumers for the emotional distress it caused after customers relied on the platform in various aspects of daily life,” The Consumer Dispute Settlement Commission said Friday.

Fifty consumers had filed for collective dispute mediation on Dec. 8 last year, seeking compensation from Coupang. The commission began mediation proceedings on April 6 and held two sessions on July 10 and 22.

Coupang’s data breach came to light last November, after a former employee leaked the personal information of around 34 million people. The incident sparked widespread public anger because Coupang failed to detect and respond to the breach proactively and only learned of it through a customer complaint.

The commission cited the highly private nature of the exposed data as a key factor. The leaked information included names, email addresses, home addresses, apartment entrance passcodes and order histories.

The commission also weighed the concrete risk that the data could be misused. The hacker extracted information over an extended period from April through November last year and sent breach-related emails to some customers.

In June, the Personal Information Protection Commission imposed a record-high fine of 624.68 billion won on Coupang over the breach and related violations, citing similar concerns.

In setting the compensation at 100,000 won, the dispute settlement commission pointed to court rulings that have typically awarded around that amount in major data breach cases.

Coupang offered customers 50,000 won product vouchers as compensation in January. The company, however, did not disclose how many of the vouchers were redeemed, which the commission cited as another reason additional compensation was necessary.

“To increase the likelihood that the mediation decision will be accepted, we decided to allow payment in either cash or Coupang Cash,” the commission said.

Coupang must notify the commission within 15 days of receiving the written decision whether it accepts the proposed settlement.

If both parties accept, the agreement carries the same legal weight as a court-mediated settlement. The commission’s ruling is not legally binding, however, and the mediation fails if either party rejects it. In that case, the consumers who sought mediation would need to pursue compensation through a civil lawsuit.

BY KANG BO-HYUN [[email protected]]