Massive Data Breach and Korean Government Crackdown
South Korea’s largest e-commerce platform, Coupang, suffered a massive data breach in 2025 that exposed personal information from about 33.7 million customer accounts . The breach began in late June 2025 via overseas servers and was not discovered by the company until mid-November . Investigations revealed that a China-based former employee had illicitly retained an active access key after leaving the company, using it to siphon customer data . The compromised data included names, emails, phone numbers, addresses and some order histories, though Coupang stated no payment information or passwords were leaked . The incident is considered South Korea’s worst data leak in over a decade, triggering public outrage, class-action lawsuits, and a government inquiry into Coupang’s data security practices  .
South Korean authorities responded with an unprecedentedly heavy hand. Within days, police and regulators launched a wide-ranging probe of Coupang’s operations  . Officials cited the “unprecedented” scale of the leak and what they deemed Coupang’s inadequate response as justification for a whole-of-government crackdown  . Over a dozen agencies – from law enforcement and cybersecurity regulators to tax, labor, financial, and even intelligence bodies – were mobilized to investigate Coupang . Raids and on-site inspections were carried out, hundreds of government officials were assigned to the case, and the national tax service formed a 150-person task force exclusively to audit the company  . Authorities warned that existing laws allow fines up to 3% of annual revenue for such data breaches, which for Coupang could exceed $800 million – potentially the largest penalty in Korean history  . Senior politicians in the ruling party openly called for “penalties and sanctions explicitly designed to force Coupang out of business,” with the Prime Minister urging regulators to tackle Coupang “with the same determination used to wipe out mafias” . Lawmakers even summoned Coupang’s founder and chairman Bom Kim – a U.S. citizen – to appear before the National Assembly for questioning, an unusual step seen by Coupang’s backers as a hostile move  .
Domestic Backlash and Political Context
Small business owners and merchants rally on Jan. 7, 2026, at the National Assembly in Seoul to protest Coupang’s “abusive” market practices and urge stronger regulations.
The aggressive stance of Korean authorities has been fueled in part by domestic backlash against Coupang. Small business associations and merchant groups accuse Coupang of exploiting its dominance at the expense of local retailers. In early January 2026, hundreds of self-employed merchants gathered on the steps of the National Assembly, holding a “Coupang condemnation rally” to protest the company’s “unchecked bullying and the ruin of small businesses.” Over 1,000 attendees, including members of the ruling Democratic Party, demanded that lawmakers enact tough regulations to curb Coupang’s alleged monopoly and unfair practices  . Protest leaders argued that Coupang had promised small sellers new opportunities but instead “betrayed that promise” by leveraging its market power to squeeze them – for example, forcing merchants to bear high commission fees and delivery costs while offering perks like free shipping to consumers  . They urged Parliament to launch a formal inquiry and to impose measures to protect local businesses from what they called Coupang’s predatory behavior . This public and political pressure at home created a charged atmosphere in which the government’s hardline approach to Coupang’s data breach gained broad support as part of a broader push to rein in big tech platforms.
Politically, the situation has also been colored by rising anti-monopoly and nationalist sentiments. President Lee Jae-myung and his administration, which took power in 2025, campaigned on holding large platforms accountable and promoting fairness for Korean firms. Key figures in Lee’s government have ties to local tech rivals – for instance, the SME minister and culture minister appointed by Lee are former executives of Naver, a domestic internet giant that competes with Coupang in e-commerce  . Critics claim these appointments indicate a bias against Coupang. The fact that the perpetrator of Coupang’s breach was a Chinese national led some opposition voices to demand a tougher stance toward China, but President Lee downplayed the nationality aspect, pointedly asking, “So what if the hacker was Chinese? If it were an American, should we hate America?” – a remark intended to quash “unfounded agitation” but which opponents seized on as evidence of a “pro-China” tilt  . Indeed, the Democratic Party government’s approach to the Coupang affair has been entangled with geopolitics in the eyes of its critics, who argue that Seoul is appeasing Chinese interests while being unusually harsh on an American company.
U.S. Investors’ Allegations of Unfair Treatment
The fallout from the breach took an international turn when two major U.S. investors in Coupang – venture capital firms Greenoaks Capital and Altimeter Capital – decided to intervene. On January 22, 2026, these investors filed a petition with the U.S. government, accusing South Korea of discriminating against Coupang and seeking an investigation and remedial action  . In parallel, they served Seoul with a formal Notice of Intent to pursue arbitration under the Korea–U.S. Free Trade Agreement (KORUS FTA) investment chapter  . Together, these moves escalate the dispute from a company-level controversy to a potential international trade conflict .
The U.S. investors allege that the Korean government’s response to Coupang’s data incident has been extraordinarily punitive and biased, far exceeding normal regulatory enforcement  . In their filings, they outline several key grievances:
• Selective Enforcement: They describe a “multi-year pattern” of Korean regulators singling out Coupang with frequent investigations, audits and raids, “more penalties against Coupang than any other company in Korean history,” while domestic Korean and Chinese competitors faced comparatively lax scrutiny . For example, they note that as Coupang’s market share grew, enforcement actions by agencies ranging from the Fair Trade Commission to the tax authority “increased” in an effort to hobble the company  .
• Inflating a Limited Breach: The investors characterize the November 2025 leak as a “limited and contained data incident,” noting that although 33 million accounts were accessed, the malicious actor only downloaded data from roughly 3,000 accounts and did not obtain sensitive financial info or passwords  . They accuse senior officials of ignoring these facts and “falsely framing the incident as involving tens of millions of victims” – even suggesting, without evidence, that home entry door codes were compromised – in order to inflame public outrage and justify a crackdown  . (Notably, Coupang has maintained that the hacker deleted the data and did not further disseminate it .)
• Disproportionate “Whole-of-Government” Campaign: After the breach disclosure, the ruling party allegedly “mobilized more than a dozen government bodies over several weeks” to “target, disable, and destroy” Coupang’s Korean business  . The petition claims that agencies with little connection to data security (such as labor, customs, and land use regulators) were roped into an all-out offensive: multiple raids were conducted, unrelated business deals involving Coupang were blocked, and even the national pension fund was pressured to divest its Coupang stock holdings  . An 86-member police task force and a 150-member tax audit team were devoted to probing the company  , an intensity the investors say “far exceeds” normal practice.
• Threats to Destroy the Company: According to the U.S. investors, officials in President Lee’s Democratic Party have explicitly called for measures to drive Coupang out of business. The petition cites statements from Korean leaders advocating fines so massive they could bankrupt Coupang, talk of revoking its licenses, and references by one official likening the enforcement campaign to “wiping out mafias”  . They highlight that criminal investigations have even been opened against Coupang executives who are U.S. nationals – including founder Bom Kim and Coupang Korea’s Chief Administrative Officer, Harold Rogers – implying these are retaliatory or intimidation tactics  .
• Bias Favoring Local and Chinese Competitors: The core accusation is that Coupang is being punished not purely for the breach, but for its success at the expense of favored Korean and Chinese companies. The investors claim that once Coupang began significantly challenging “the longstanding market dominance” of domestic players (like Naver) and certain Chinese firms, the Korean government seized upon the breach as a convenient “pretext” to weaponize its regulatory powers against a U.S.-based competitor  . In their view, the administration’s goal is to hobble Coupang’s operations so that it “cannot effectively compete” with Korean and Chinese rivals, rather than to protect consumers  . They point to President Lee’s appointment of former Naver executives to key posts (in their words, staffing the government with “individuals from Coupang’s competitors to find excuses to attack Coupang”) and note that the suspected perpetrator of the breach being Chinese was treated as a side issue – reinforcing their belief that the “pro-China” government is less interested in the Chinese hacker and more interested in taking down an American firm  .
These allegations are summed up in an unusually blunt tone. In their petition, the investors label President Lee Jae-myung’s administration as “anti-American and pro-Chinese” . They even draw a provocative analogy, saying the Korean government’s conduct is something one would expect only from “a totalitarian adversary like Venezuela or Russia,” not from a U.S. ally  . (In fact, their letter pointedly references Venezuela, noting that such tactics are reminiscent of an enemy state – an allusion made more jarring by the news that the U.S. military had recently executed an operation to apprehend Venezuela’s president Nicolás Maduro, implying South Korea is behaving like a rogue state  .) The investors argue that under President Lee’s rule – which they describe as a “anti-U.S., pro-China regime” – Coupang’s very survival is under threat  . They cite Lee’s past rhetoric (for example, he once referred to U.S. troops in Korea as “occupiers” and claimed the U.S. bore responsibility for prolonging Japan’s colonization of Korea) as evidence of a political climate hostile toward American interests  . In sum, Greenoaks and Altimeter contend that South Korea has engaged in “illegal actions” that violate the protections guaranteed to U.S. investors under the KORUS FTA and international law, causing billions of dollars in damage to Coupang’s market value (Coupang’s NYSE-listed shares have plummeted ~27% since the breach was revealed) and inflicting heavy losses on American shareholders  . They signal intent to seek “hundreds of millions of dollars” (if not more) in compensation for these losses if the dispute is not resolved  .
From Corporate Dispute to Trade Conflict
By taking their case to Washington, Coupang’s investors are attempting to turn up the pressure on Seoul through official channels. Section 301 of the U.S. Trade Act of 1974 – under which Greenoaks and Altimeter have petitioned the U.S. Trade Representative (USTR) – empowers the U.S. government to investigate and respond to unfair trade practices by foreign governments . Any interested party can file a Section 301 petition, and the USTR must decide within 45 days whether to launch a formal investigation  . In this case, the investors are urging USTR to examine South Korea’s “unreasonable and discriminatory” actions and, if warranted, to impose trade remedies – potentially new tariffs or import restrictions on Korean goods and services  .
Should the USTR proceed, the dispute could quickly escalate into a government-to-government trade confrontation. An official investigation would entail consultations with the South Korean government; if those talks fail to resolve the issues and USTR finds that U.S. investor rights were indeed violated, the U.S. could retaliate with punitive measures  . This raises the specter of tariffs being levied on South Korean exports – a significant move that would mark a sharp departure from the cooperative trade relations the two allies usually enjoy  . Observers note that what began as a cybersecurity incident could spiral into a broader trade rift. “The moves could escalate a corporate dispute into a potential government-to-government trade issue,” Reuters commented, potentially invoking not just U.S. trade law but also an international treaty (the FTA) to challenge Seoul’s actions .
In tandem, the investors’ notice of intent to arbitrate under the KORUS FTA triggers a diplomatic process. Under KORUS, once a notice is filed, a 90-day “cooling-off” period begins during which the parties are supposed to consult and attempt an amicable resolution . If no agreement is reached in that window (which would end around April 2026), the U.S. investors could proceed to file a formal claim for Investor-State Dispute Settlement (ISDS) arbitration against South Korea . They would likely argue that South Korea breached commitments in the FTA to treat U.S. investments fairly and equitably. The investors have already signaled that if it comes to arbitration, they will seek to recover the value lost due to Seoul’s actions – which they estimate as “at least hundreds of millions of dollars now, and potentially tens of billions in future losses” when factoring in Coupang’s eroded market capitalization and growth prospects  . Such an arbitration case would be high-profile: Coupang’s situation could become a test of the strength of investor protections in the U.S.-Korea FTA and might deter foreign investment in Korea if investors perceive political risk.
Responses from Seoul and Implications
South Korea’s government strongly denies that it is targeting Coupang out of bias, and it has bristled at the U.S. investors’ characterizations. President Lee Jae-myung, when asked about the dispute, emphasized that “South Korea is a sovereign nation” that will handle the Coupang case fairly and by the book, according to its laws and principles . He rejected the notion of outside interference, implying that the investigation into the data breach is an internal matter of law enforcement, not an issue of international politics or trade. Likewise, South Korea’s Trade Minister Yeo Han-koo (who recently traveled to Washington to discuss U.S. concerns) stated that the government’s actions are not discriminatory and that any U.S. perceptions to the contrary are “misunderstandings” . Yeo argued that the **“unprecedented” nature of the data leak, combined with what Seoul saw as Coupang’s slow or insufficient cooperation initially, warranted a tough response – one he insists is motivated by legitimate consumer protection and security concerns, not trade protectionism . He also drew a pointed comparison: if an equivalently massive breach were caused by a Korean company operating in the United States, Yeo suggested, “the U.S. would naturally do the same” in terms of investigation and penalties . This comment underscores Seoul’s view that its actions are within normal bounds by international standards for such a serious cybersecurity failure.
Korean officials have been treading carefully, aware that the issue could strain ties with Washington. As of late January 2026, the USTR had not publicly commented on the petition , and it remains to be seen whether the Biden (correction: Trump) administration will take up the case with gusto or seek a quieter resolution. If USTR does launch a Section 301 investigation, it could entangle other areas of the tech trade relationship. U.S. policymakers have already shown sensitivity to South Korea’s regulatory moves affecting foreign tech firms. In late 2025, for instance, U.S. officials criticized Seoul’s proposed digital regulations – such as a new law against online disinformation and an “online platform fairness” act – as potentially undermining free speech and unfairly targeting U.S. tech companies  . (Indeed, the U.S. Trade Representative even canceled a scheduled bilateral trade meeting in protest of those digital bills, according to news reports.) Now, with the Coupang dispute, there are fears of a broader trade rift: what started as a cybersecurity enforcement matter could snowball into a flashpoint in U.S.-Korea economic relations if handled poorly. South Korea’s leadership has thus shown some signs of trying to de-escalate, for example by dispatching Trade Minister Yeo to explain Seoul’s position in Washington and by reiterating that Coupang will be treated “fairly… according to law” rather than punished arbitrarily .
Ironically, the investors’ invocation of the KORUS FTA comes at a time when that agreement’s spirit of free trade has been undermined by U.S. trade policy itself. In April 2025, President Donald Trump imposed sweeping “reciprocal tariffs” on U.S. trading partners, including a hefty 25–26% tariff on South Korean goods, as part of a global protectionist push  . This unilateral move – a 10% blanket tariff on all imports plus an extra 25% on South Korea specifically – “practically nullified” the tariff-elimination benefits of the U.S.–Korea FTA  . (Korean officials lamented that Trump’s action rendered KORUS’s market access provisions meaningless, since duty-free treatment was overridden by the new tariffs .) In this context, some observers find it ironic that U.S. investors are accusing Korea of violating KORUS, when the U.S. itself has been flouting the agreement’s free-trade principles with protectionist measures. Nevertheless, the legal protections for investors in the FTA remain in force, and Greenoaks and Altimeter are leveraging those provisions to seek redress. The South Korean side may privately question the optics – pointing out, for example, that Washington breaking the FTA’s spirit makes it awkward to accuse Seoul of breaching the FTA – but formally, Seoul must still respond to the arbitration notice through the treaty mechanisms. If the issue escalates, it could put the FTA under unprecedented strain, just as the two countries are negotiating other aspects of their economic partnership.
Outlook: Alliance on the Line?
The coming weeks will be crucial in determining whether this dispute can be defused or will blaze into a full-blown trade clash. U.S. investors have made concrete demands: they want an end to what they call discriminatory harassment of Coupang and a restoration of “fair and predictable” business conditions for American companies in South Korea  . In practical terms, that likely means urging the Korean government to scale back its investigations to a “normal” scope, refrain from excessive penalties, and allow Coupang to compete on equal footing. If Seoul quietly adjusts its approach – for instance, by coordinating with U.S. officials, expediting the probe’s conclusion, or ensuring any fines are proportionate – the investors might be satisfied enough to withdraw the Section 301 petition or the arbitration threat. Indeed, the 90-day consultation window under the FTA is an opportunity for diplomacy: U.S. and South Korean trade officials could negotiate a solution (perhaps involving commitments by Coupang to improve compliance, along with assurances from Seoul of no “death penalty” regulation) that heads off further confrontation.
However, if neither side backs down, the stakes will rise. An actual USTR investigation would open a new rift in the U.S.–Korea alliance, possibly leading to tariffs on Korean exports at a time when global economic headwinds are strong. That could invite Korean retaliation or at least significant diplomatic fallout. Moreover, a public trade fight could have a chilling effect on foreign investment into Korea, as it casts doubt on the stability and fairness of the business environment. South Korea has to balance its domestic political imperative – holding Coupang accountable and appeasing local constituencies – with its international reputation as a fair market for global investors. Likewise, the U.S. administration (under President Trump) must balance a tough-on-trade stance with the strategic importance of South Korea as an ally; an overly aggressive intervention could be seen as the U.S. undermining Korea’s sovereignty or favoring one company, which might not sit well in Seoul.
One positive sign is that dialogue is ongoing. Korean officials reported that after explanations, some U.S. counterparts “understood” that Korea’s actions were not an attack on U.S. businesses per se  . This suggests room for a mutually face-saving resolution. For instance, South Korea might conclude its investigation and impose a moderate fine (enough to show it’s enforcing the law, but not so high as to cripple Coupang), while Coupang commits to additional consumer protections – and the U.S. investors, in turn, drop their petition and arbitration claim. Such an outcome would contain the damage. On the other hand, if the investors remain unsatisfied and push forward, this case could become a landmark test of how far the U.S. will go to defend a single company’s interests abroad, and how much pressure Seoul is willing to endure on its domestic policies.
In summary, the Coupang saga has evolved from a cybersecurity failure into a multi-faceted clash involving issues of data privacy, market competition, foreign investment, and even geopolitical alignment. It has exposed frictions in the U.S.–Korea economic relationship at a time of broader tensions (over technology, digital policy, and trade imbalances). The coming resolution – whether through quiet settlement or open conflict – will likely have lasting implications. It will signal to other multinational companies and investors just how secure their ventures are under trade agreements, and it will test the resilience of the U.S.–South Korea partnership when commercial and strategic interests collide. Both sides have much to lose if missteps are made: for South Korea, a reputation as a fair and open market is on the line, and for the U.S., the commitment to defending its companies without politicizing alliances will be scrutinized. As one U.S. investor involved warned, “trade agreements are only as strong as our willingness to stand up for them”  – a statement that now confronts both Washington and Seoul with the challenge of reconciling rule-of-law principles with realpolitik in this high-profile dispute.
Sources:
• Hyunjoo Jin & Joyce Lee, Reuters – “South Korean police probe massive data leak at Coupang”  
• Hyunjoo Jin & Krystal Hu, Reuters – “Coupang investors seek US probe over South Korea’s handling of data leak”  
• Business Wire – Greenoaks press release “Greenoaks Takes Legal Action to Stop Korea’s Discrimination Against Coupang…”  
• Cha Min-young, Asia Economy – “Coupang Investors Request U.S. USTR Investigation…Trade Dispute Escalation”  
• Kang Tae-hwa, JoongAng Ilbo (via Korea Daily) – ““Lee President is pro-China, Korea is Venezuela”…Coupang Investors Ask for U.S. Intervention”  
• KBS World – “Investors Seek US Investigation into S. Korea’s Treatment of Coupang”  
• Ju-min Park et al., Reuters – “South Korea’s acting president calls for talks with US over tariffs”  (context on KORUS FTA)
• Hwang Tae-gyu, Smart Today – “National small business rally: ‘Coupang destroying self-employed’”  
'경제와 산업' 카테고리의 다른 글
| 한국 증시 ‘수요 없는 상승장’의 실태 – 코스피 주가 현황 심층 분석 (0) | 2026.01.23 |
|---|---|
| IMF Warns of Korea’s High Dollar Exposure Amid Retail Investment Boom (0) | 2026.01.18 |
| [닐의 통찰] 미국의 100% 반도체 관세 압박과 한국 메모리반도체 산업의 현실적 충격 (0) | 2026.01.17 |
| 삼성 홍보팀의 언론홍보와 민심 괴리: 구조적 분석 (0) | 2026.01.16 |
| 미국-대만 반도체 관세 면제 조건과 한국 반도체 산업 영향 분석 (0) | 2026.01.16 |