SEOUL, South Korea — South Korea’s data protection watchdog on Wednesday urged online retailer Coupang to take down the results of its independent internal probe into a major data breach, saying the information posted by the company has not been officially verified and could mislead the public.
The Personal Information Protection Commission objected to a notice published by Coupang stating that a former employee had accessed personal data belonging to about 33 million users but saved information from only around 3,000 accounts, which the company said was later deleted.
Coupang remains under investigation by authorities over the breach, which the company disclosed in November and said affected the personal data of approximately 33.7 million customers, including names, phone numbers, and delivery addresses.
The regulator said Coupang’s disclosure of its internal findings could create confusion, as the conclusions have not yet been confirmed through an official investigation. The commission also warned that publishing such information could be viewed as interfering with the ongoing probe.
The watchdog further accused Coupang of being uncooperative with the investigation, citing delays or failures in submitting requested documents. It said such behavior could be regarded as obstruction and may be taken into account when determining potential penalties.
The commission also called on Coupang to strengthen its response measures, including adding a function on its mobile app and website that would allow users to check whether their personal data had been compromised.
Separately, South Korea’s antitrust regulator said stronger measures, including a temporary suspension of business operations, remain an option as investigations continue.
“If an order is not implemented or if it is deemed insufficient to provide relief to affected consumers, a business suspension is also possible,” Ju Byung-gi, chairman of the Fair Trade Commission, said in a radio interview.
Coupang had announced the results of its internal probe on December 25, stating that a former employee stole personal information from 33.7 million user accounts but retained data from only about 3,000 accounts, which the company said was later deleted. (Source: IANS)
