Coupang. Yonhap News

The recent controversy surrounding Coupang has escalated beyond a simple personal information leak by a large platform, evolving into a national issue intertwined with politics, industry, labor, and international competition. The punitive fine of '3% of sales' that the government is considering could reach an unprecedented 1.3 trillion won. Some in the political sphere are discussing the abolition of dawn delivery or a review of business suspension, which could realistically jeopardize the company's sustainability. However, there are growing criticisms that the more the controversy escalates, the more the essential nature of the issue is obscured. What we should be focusing on now is not an emotional judgment of Coupang as a company, but the entire infrastructure of Korean daily life, logistics network, and employment structure that the company supports. The real issue is the practical problem that Coupang's collapse could lead to national-level risks. 

The controversy over the severity of penalties against Coupang is shaking Korea. In the past few years, large domestic ICT companies have experienced information leakage incidents involving tens of millions of people, yet the fines have ranged from billions to at most hundreds of billions of won. Kakao Pay, despite providing information of 40 million people to Alipay in China without consent, was fined only 5.9 billion won. In Kakao's open chat, information of 65,000 people, including names and phone numbers, was leaked, resulting in a fine of 15.1 billion won. SKT's leakage of 26.96 million SIM card-related information was also fined 134.7 billion won. However, as discussions emerge about applying the highest level of punishment, '3% of total sales,' for a single incident at Coupang, voices of concern about the collapse of consistent penalty standards are rising within the industry. Such inequitable regulation is not just a problem for a specific company but leads to issues of trust in the entire economic system, a warning that it can be a factor that restricts not only corporate activities but also investment, employment, and technological innovation.

Furthermore, other debates surrounding Coupang are complexly intertwined with labor union conflicts, political interests, and international competition dynamics that have persisted over the past few years. Since the Coupang Labor Union withdrew from the Korean Confederation of Trade Unions (KCTU) last year, the KCTU has continuously raised issues regarding dawn delivery, increasing pressure. Some in the political sphere have brought this to the forefront as a policy issue, further intensifying the conflict. 

In addition, large platform companies from China, such as Temu and Ali, are already making a comprehensive push into the Korean market by investing heavily in logistics networks and deploying personnel. However, the likelihood of the jobs they create going to Koreans is low. In fact, there is an increase in delivery personnel, primarily Chinese nationals, in the Seoul metropolitan area, and a model where production, logistics, and profits are all repatriated to the Chinese headquarters is rapidly expanding. The strategy employed by Chinese platform companies in various countries worldwide has been to first secure market share through ultra-low-price offensives, and then, once a certain level is reached, to raise prices and exclude competitors. The reason for the ongoing warnings is that if Coupang disappears, what remains is likely not low-price competition but a dependent distribution structure centered around foreign platforms.

However, the most neglected group in this debate is the frontline workers who actually operate the Coupang ecosystem. There are hundreds of thousands of jobs connected to the Coupang ecosystem, including dawn delivery drivers nationwide, logistics center loading/unloading and delivery personnel, production workers at partner companies, farmers, and food factories. A couple who have been dawn delivery drivers for three years said, "If Coupang disappears, it's not just inconvenient for customers; our livelihoods will be immediately ruined. Talk of business suspension is the same as talk of livelihood suspension for us." In reality, Coupang's dawn delivery structure is less like simple parcel delivery and more like a "living logistics system" where hundreds of supply chains, including supermarkets, farms, food companies, logistics centers, and couriers, are interconnected. If Coupang falters, the national employment system will be directly impacted, and the repercussions could spread to regional economies, small and medium-sized enterprises, and self-employed individuals.

This incident, confirmed to have originated not from a sophisticated cyber attack from the outside but from improper access by a former developer with internal authority, has brought to light fundamental weaknesses in internal control design that companies commonly face amidst the acceleration of digital transformation (DX). The fact that Coupang's authentication keys were not revoked for a long period and that the mass download monitoring system and log monitoring did not function adequately are clearly issues that need improvement. However, security experts point out that these vulnerabilities are not unique to Coupang but represent the reality of the entire Korean platform industry, which has experienced rapid growth and possesses complex technological structures. E-commerce, logistics, platform, and fintech companies operate based on hundreds of millions of data points and massive traffic, but internal access management, key rotation, and access control policies have been relatively low priorities. In particular, the combination of names, phone numbers, addresses, and purchase history is a data combination that can significantly increase the success rate of smishing and voice phishing attacks. As seen in overseas cases like Amazon and DHL, crimes impersonating "delivery errors" can spread exponentially even with only partial personal information. Furthermore, with criminal organizations now fully utilizing artificial intelligence (AI) technology, sophisticated attacks that automatically generate voice, facial, and conversational patterns have emerged, leading to an assessment that the risk of personal information leakage has risen to an entirely different level than in the past. 

The government should institutionalize measures such as mandatory internal insider management, advanced access control, enforced key rotation, mandatory log monitoring, and expanded system encryption and DRM, defining this incident as a national security crisis. There is a prospect that Coupang's incident will become a turning point for companies to perceive security not as a "regulatory cost" but as a "survival cost." There are also arguments that this situation should be used as an opportunity to address the generational gap in security system design, rather than condemning the entire company.