Scale of the breach shocks regulators and public The June 2025 intrusion into Coupang’s servers exposed personal data—names, addresses, phone numbers—of roughly 34 million customers, the largest data‑leak in South Korean history [1][2]. The company only detected the breach in December, five months after the initial exfiltration began on overseas servers [2]. The delayed discovery amplified concerns about corporate monitoring and notification practices.

Former Chinese employee identified as likely culprit Police investigations traced the illicit IP address to a former employee of Chinese nationality who had already left South Korea [1][2]. Authorities continue to track his digital footprints while confirming his role as the primary actor behind the data exfiltration [1]. The suspect’s departure complicates extradition and prosecution efforts.

President Lee demands stronger penalties and punitive damages At a cabinet meeting on Dec 2, President Lee Jae Myung urged the adoption of a punitive damages regime that would impose compensation beyond actual losses to deter future leaks [1]. He called for a “paradigm shift” in digital security, directing ministries to mobilize resources against secondary harms such as identity theft [1]. The administration plans to fast‑track legal reforms to embed harsher sanctions.

Chief of staff highlights flaws in current punitive‑damages system Kang Hoon‑sik, the presidential chief of staff, warned that the existing punitive‑damages mechanism is “virtually not functioning,” limiting its deterrent effect [2]. He tasked the Ministry of Science and ICT and the Personal Information Protection Commission with reporting on institutional reforms and corporate security support [2]. The critique underscores a gap between policy intent and practical enforcement.

Government prepares comprehensive institutional response Beyond penalties, the cabinet ordered a full investigation into the breach’s cause and mandated ministries to develop safeguards against secondary damage [1]. Plans include deploying all available resources to prevent fraud and identity theft stemming from the leaked information [1]. The coordinated effort aims to restore public confidence in South Korea’s digital ecosystem.