Coupang Rejects $70-per-User Data Breach Settlement Offer

What happened

Coupang, South Korea's largest e-commerce platform, has declined to accept a mediation proposal from the Korea Consumer Agency's Consumer Dispute Settlement Commission that would have required it to pay 100,000 won (roughly $70) per affected user over a data breach that occurred late last year. The company submitted its written refusal to the commission on the 11th, and the decision surfaced in Korean media on the 16th.

Coupang framed its reasoning around two points: the remedial steps it says it took on its own initiative after the incident, and the broader internal and external consequences of accepting the proposed terms. Consumer advocacy voices in Korea reacted sharply, with some calling the stance brazen.

Why a company can simply say no

Korea's consumer dispute mediation system is not a court. A settlement takes effect only if both parties accept it; if either side refuses, nothing is binding. When accepted, the agreement carries the force of a court-approved settlement — but nothing compels a company to get to that point in the first place. That design leaves a structural exit for any business that judges the payout too large.

The arithmetic here is straightforward. A per-person figure multiplies by the number of affected accounts, and in a breach touching a consumer platform of Coupang's scale, that number is not small. The company's reference to "external repercussions" reads as an acknowledgment that accepting 100,000 won per head would effectively set a benchmark for every remaining claimant.

How this compares to past Korean breach cases

Outcomes in Korea's large-scale data breach litigation have been inconsistent. In class actions following repeated leaks at credit card issuers, telecom carriers and portal operators, courts have at times awarded damages in the range of tens of thousands to 100,000 won per plaintiff, and at other times dismissed claims entirely on the grounds that the operator's failure to meet its statutory security obligations was not proven. In other words, litigation is not a guaranteed improvement over the rejected offer.

For a defendant, that uncertainty is itself leverage. Civil suits in Korea can run for years, individual plaintiffs bear the burden of proof and legal costs, and participation tends to erode over time. Refusing mediation is legally permitted — but it also invites the criticism that a company is using claimants' time and expense as a shield.

What this means for affected users

With mediation off the table, the remaining route to compensation is a civil lawsuit. The contested issues will be the scope of the leaked data, whether concrete harm occurred (spam, phishing, secondary identity misuse), and whether the company met its technical and administrative protection duties. Practically, that means keeping breach notification messages and any records of suspicious logins or phishing attempts is worth doing now rather than later.

Account hygiene matters independently of the legal fight. Anyone reusing the same password elsewhere should change it, enable two-factor authentication, and treat unsolicited messages targeting the exposed contact details with suspicion. Leaked data does not get recalled, regardless of how the compensation dispute ends.

The bigger question for platform regulation

The refusal is a test of how much weight Korea's consumer mediation framework actually carries against a dominant platform. If declining a proposal carries no penalty, mediation becomes a process companies opt into when the math favors them. Recommendations without enforcement power show their limits precisely in cases like this one.

Regulatory exposure, however, has not gone away. Administrative sanctions under Korea's Personal Information Protection Act — including fines — proceed independently of whether a mediation offer is accepted. What Coupang sidestepped is one phase of the civil compensation process, not the matter as a whole.