Tsai Fu-jung (from left), director-general of Taiwan’s Administration for Cyber Security under the Ministry of Digital Affairs; Chan Ting-i, chairman of the Taiwan Digital Trust Association; and Chen Hao-wei, information security chief for Coupang Taiwan and Japan, pose for a photo at the “921 Taiwan Cybersecurity Day.” Photo courtesy of Coupang Taiwan
South Korea and Taiwan are taking divergent approaches to Coupang after the company was penalized in both countries over personal data breaches. In Korea, a record fine was followed by criticism at a parliamentary audit over the company’s data protection responsibilities. In Taiwan, the government is pursuing public-private cooperation with Coupang on cybersecurity, separate from holding the company accountable for the breach.
Coupang Taiwan last month teamed up with the Taiwan Digital Trust Association to run a “Taiwan Cybersecurity Day” campaign, according to industry sources on the 9th. The campaign was supported by the Administration for Cyber Security under the Ministry of Digital Affairs, the Investigation Bureau of the Ministry of Justice and the Criminal Investigation Bureau of the National Police Agency under the Ministry of the Interior. As part of the campaign, Coupang led the construction of the “Taiwan Cybersecurity Day” website. The company plans to continue working with the association to strengthen digital security capabilities across Taiwanese society.
Coupang had earlier been fined about 65 million won by Taiwanese authorities after the personal data of roughly 200,000 people was exposed in the country. Even so, Taiwanese authorities are also treating Coupang as a private-sector partner in cybersecurity. The approach holds the company strictly accountable for the breach while drawing on its security capabilities to reinforce cybersecurity across society.
Analysts attribute the stance to Coupang’s sustained investment in information security and the technology and personnel it has accumulated. According to information security disclosures compiled by the Korea Internet & Security Agency (KISA), Coupang spent 134.9 billion won on information security last year, the second-largest amount among Korean companies after Samsung Electronics (005930.KS).
In Korea, by contrast, political pressure over Coupang’s data protection responsibilities has persisted even after the record fine. Brett Mathis, Coupang’s chief information security officer, appeared as a witness at a parliamentary audit held by the National Assembly’s Science, ICT, Broadcasting and Communications Committee on the 6th. Rep. Lee Hoon-ki of the Democratic Party pointed to a wide gap between the scale of the data breach disclosed by Coupang and the figures announced by the government, urging Bae Kyung-hoon, deputy prime minister and minister of science and ICT, to take firm action.
Some observers point to the gap between the Korean and Taiwanese responses as an argument for expanding public-private cooperation so that cybersecurity capabilities built up by individual companies can be put to broader use. That argument has gained traction as hacking attacks and data breaches have hit major Korean companies, including financial firms, in recent months.
Mathis said at the committee audit on the 6th that the company has been working to strengthen its information security systems, and apologized for the inconvenience caused to the public by the breach. It was his second appearance before the National Assembly in about 10 months, after he apologized at a hearing on the Coupang breach in December.