Coupang has filed suit to overturn the largest privacy penalty ever imposed in South Korea, asking a court to cancel fines of about $461 million over its 2025 data breach, The Korea Herald reported Thursday. Hours later, an overnight outage took down Coupang's shopping app and related services for about two hours, prompting users to ask whether the company had been hacked again, The Korea Times reported.

What Happened

Coupang filed two suits with the Seoul Administrative Court Wednesday, according to the Herald. One seeks to cancel the penalties imposed by the Personal Information Protection Commission, and the other asks the court to suspend them until it rules.

The commission's penalty totals 624.9 billion won, about $461 million, plus 16.8 million won in administrative fines. Of that, 423.6 billion won relates to the breach itself, and 201.1 billion won covers other violations, including tracking the activity of more than 10 million members on outside websites. An affiliate, Coupang Fulfillment Services, was fined 248 million won separately for mishandling personal and sensitive information.

RelatedCybersecurity Incident at BAE Systems Halts Notices From U.S. Bankruptcy Courts

The breach, disclosed in November 2025, affected 33.22 million members and at least 4.33 million non-members. The commission's final tally added 3.88 million victims to its earlier estimate. Regulators said Coupang failed to put basic protections in place, pointing to poor management of authentication keys and inadequate controls on system access.

Coupang said its early steps to prevent secondary harm from the breach, and explanations it says were based on clear facts, were not fully reflected in the commission's decision. The company said it expects the court process to establish the facts.

The Outage

Coupang's website and app, food delivery service Coupang Eats and streaming service Coupang Play went down around 1 a.m. Friday Korea time, or about noon Thursday in New York, The Korea Times reported. Users saw network error messages and could not log in, search for products, view account information or track orders. Service returned after about two hours.

Customers who called the service center were told an internal system error was responsible, the Times said, but the company did not disclose a specific cause. On online forums, users asked whether the disruption was another cyberattack.

Why It Matters

Coupang is South Korea's largest e-commerce platform, so its breach touched a large share of the country's population, and the penalty is the biggest Korea has issued for a single data leak as well as the largest total against one company. A court decision to suspend or reduce it would shape how forcefully the commission can use its fining powers against large platforms.

Whatever its cause, the outage showed how little benefit of the doubt the company has with customers. With no explanation offered, users quickly raised the possibility of another attack, shortly after Coupang went to court to contest regulators' findings about its security.

What to Watch

The Seoul Administrative Court will first decide whether to halt the fines while the main case proceeds. Coupang has not yet given a root cause for the outage, and if it turns out to involve a security incident, the company would likely face fresh questions from regulators.