Unprecedented Leak of Sensitive Information
Coupang May Offer Wow Membership Fee Reductions?
Impact of 33.7 Million Records Leaked... Monetary Compensation to Be Decided Through Lawsuits
Rare Case of Leakage Including Personal Lifestyle Information... Growing Demands for Compensation
Past Breaches Followed the Pattern: Monitoring → Coupons → Damages
There is growing interest in how Coupang will establish a compensation system for customers affected by the unauthorized exposure of 33.7 million personal information records. Considering precedents from major domestic data breaches, it appears likely that Coupang will follow a three-stage compensation structure: providing monitoring services, offering voluntary compensation such as coupons, and monetary compensation through class action lawsuits.
According to the retail industry on December 4, Coupang CEO Daejun Park appeared before the National Assembly’s Political Affairs Committee the previous day and stated, “Once the scope of the damage is confirmed, we will devise a reasonable solution,” adding, “We will actively consider compensation for those affected.”
On the 3rd, in front of Coupang headquarters in Songpa-gu, Seoul, participants held a performance urging apology and responsibility at the "Coupang Personal Information Leakage Collective Dispute Mediation Application Kickoff Press Conference" organized by the People's Solidarity for Participatory Democracy, the Committee on Livelihood Economy of the Lawyers for a Democratic Society, and the Korea Consumer Federation. Photo by Yonhap News
This Coupang leak is considered more dangerous than previous incidents because it includes not only general personal information such as names, phone numbers, and email addresses, but also address books containing recipient names, phone numbers, and delivery addresses. Cases involving the leak of address information are rare in Korea, raising concerns about smishing, parcel delivery scams, phishing calls, spam advertisements, and even crimes involving physical visits based on actual addresses.
For this reason, it is highly likely that the compensation measures will be stronger than in the past. Since the leakage of address books is a much more sensitive issue than the leakage of simple account information, the level of compensation and protective measures that Coupang will be required to provide may be set higher than in previous platform incidents.
In large-scale data breaches, the first actions companies typically take are strengthening account protection measures and providing information monitoring services. For example, following its 2016 breach, Interpark provided free monitoring services for two years, and in 2023, LG Uplus supported affected customers with identity verification history checks and enhanced account protection. Since the Coupang incident involves the leakage of address books, it is possible that even more robust monitoring services will be offered. These may include notifications for suspected smishing or phishing messages, detection of suspicious transactions using personal information, and preemptive security alerts. Additionally, Coupang may introduce separate account protection features for its membership customers by leveraging its ‘Wow Membership’ platform.
On the other hand, there have been almost no cases in Korea where companies have chosen to provide cash payments for damages caused by personal information leaks. Most compensation has taken the form of non-cash benefits such as coupons, points, membership fee reductions, or free service vouchers. For instance, in 2016, Interpark provided shopping coupons worth 10,000 and 30,000 won, and in 2017, YogiYoTta implemented enhanced account security and notification measures. In 2011, Nate and Cyworld provided security programs and monitoring services.
Since Coupang has established an ecosystem based on its Wow Membership, it is widely expected that realistic compensation could include membership fee reductions or extensions, free shipping vouchers, shopping cart discount coupons, or exclusive benefits for Rocket Delivery. This approach allows the company to reduce its financial burden while still increasing customer satisfaction, making it the most commonly chosen form of compensation in large-scale data breach incidents.
Daejun Park, CEO of Coupang, is attending the current issues inquiry held at the National Assembly Science, Technology, Information and Broadcasting and Communications Committee plenary session on the 2nd and answering questions. On the right is Brett Mattis, Coupang CISO. 2025.12.2 Photo by Hyunmin Kim
Actual monetary compensation is ultimately expected to be possible only through class action lawsuits. In major data breach cases, substantial monetary compensation has generally been awarded only after court rulings. There have been almost no cases where companies have voluntarily provided cash compensation. According to major domestic precedents, Nate and Cyworld paid 300,000 to 400,000 won per person in damages in 2011, and Interpark compensated 100,000 won per person in 2016. The following year, some YogiYoTta customers were awarded damages, and Hana Tour paid small compensation amounts.
The amount of compensation depends on factors such as the sensitivity of the leaked information, whether the company acted intentionally or negligently, the scale of the leak, and the sincerity of the company’s response. Since the Coupang incident involves the leakage of address books, there is growing speculation that the standard for damages could be set higher than in previous cases. Currently, consumer organizations are already preparing class action lawsuits, and if the number of participants reaches several hundred thousand or even millions, the total compensation amount could be substantial.
Under the Personal Information Protection Act, administrative fines are imposed as an administrative measure, while customer compensation is a matter of civil liability. Therefore, even if Coupang is fined several hundred billion to 1 trillion won, the amount of compensation paid to customers is not directly linked. Voluntary compensation such as monitoring services or coupons provided by the company is only a response to manage customer satisfaction and public opinion, while monetary compensation is determined separately through civil litigation.
© The Asia Business Daily(www.asiae.co.kr). All rights reserved.
