Korea's consumer commission has decided Coupang owes 100,000 won each to the 50 people who asked, and says silence from either side counts as acceptance
A footnote on the second page carries more weight than the award does. If a party makes no separate expression of intent, the commission treats it as acceptance.
South Korea's Consumer Dispute Settlement Commission decided on 22 July that Coupang Corp. must pay 100,000 won to each of the 50 consumers who brought a collective dispute case over the company's data leak, and it published the decision at noon on Friday. The applicant chooses cash or Coupang Cash, the credit spendable on the company's own shopping site. The commission describes it as the first finding of damages liability against Coupang over the leak. Coupang Corp. is Korean. It appears on the list of significant subsidiaries filed with Coupang, Inc.'s most recent annual report, and the parent trades in New York as CPNG.
Why the figure is 100,000 won
Three reasons are given. Courts have generally landed inside 100,000 won in large leak cases. Coupang did not submit any figures showing how far the applicants had used the compensation it offered on its own initiative, which on 15 January took the form of vouchers worth 50,000 won in total, split 5,000 won across the site, 5,000 on Coupang Eats, 20,000 on Coupang Travel and 20,000 on R.LUX. And the commission holds that the material taken is the kind that gets misused in ordinary daily life.
On liability it is more specific. What left the company was not only names, e-mail addresses and postal addresses but door entry codes for shared building entrances, and order histories. The commission records that the intruder was inside from about April 2025 until about November 2025 and mailed some customers directly about their own data. Coupang argued that it had recovered the leaked information and every device used in the intrusion, so no further leakage was possible. The commission says that cannot be concluded.
The 50 is not the number to watch
Each side has 15 days from receiving the decision to tell the commission whether it accepts, and acceptance by both carries the effect of a judicial settlement. The release does not say what Coupang intends to do. If it accepts, the commission says it will move to the compensation plan stage so that the same payment reaches people who took no part in the case.
That is where the size of this sits. On 11 June the Personal Information Protection Commission published its own findings, counting 33,222,472 member accounts and at least 4,338,368 non-member telephone numbers, and holding that Coupang had breached duties under the Personal Information Protection Act covering safety measures, breach notification and the destruction of personal data. Coupang first reported 4,536 accounts to the Korea Internet and Security Agency on 19 November 2025. Ten days later the count was 33.70 million.
