The South Korean government announced on October 10 that a joint investigation team has identified the scope of the Coupang personal information leak, totaling over 33 million accounts. As a result, questions of criminal accountability are now heavily reliant on police investigations. The Seoul Metropolitan Police Agency's Coupang Investigation Task Force is concentrating on three main areas: identifying suspects in the data leak, examining the outcomes of Coupang's self-investigation, and clarifying the company's overall responsibility. Previously, the police conducted a comprehensive seven-day search of Coupang's headquarters in December of last year, gathering evidence to proceed with legal action.

In particular, the police are nearing the conclusion of the investigation against a former Coupang employee of Chinese nationality, who is accused of data breaches and leaking confidential information. However, a critical aspect is the suspect's current residence in China, complicating the process of extradition. The head of the National Investigative Bureau has recently requested international cooperation from Chinese authorities through visits, highlighting the challenges faced in bringing the suspect to justice. The investigation also scrutinizes Coupang’s initial claim that only 3,000 accounts were compromised, contradicting the more substantial numbers cited by the authorities.

The ramifications of this data breach investigation extend significantly to affected users, as law firm Daeryun has already filed lawsuits against Coupang and its former CEO for violations of personal data protection laws. Current legislation obligates firms to ensure robust management of personal information, and failure to adhere to these regulations could lead to severe legal repercussions. This case underlines the importance of corporate diligence in safeguarding user data and the legal consequences of negligence in such matters.