The Coupang Breach and the Danger of Punishing the Headline Number.

The headline number from the Coupang data breach — more than 33 million user accounts — sounds like a major incident that implies a catastrophic failure of one of South Korea’s most important company’s cybersecurity programs. South Korea's Personal Information Protection Commission (PIPC) measures an incident by the “exposure and access” of data, and a disgruntled former engineer who retained and forged credentials did, in principle, have access to that many accounts over seven months. But what actually happened in this case was far narrower. According to Coupang internal investigation, the attacker downloaded data from just under 3,000 accounts, and later deleted it. However, it's worth noting that regulators dispute this finding as overly narrow. The breach exposed no financial information, and he did not transfer anything to any third party. Multiple investigations and reporting to date has surfaced no fraud, identity theft, or downstream misuse traced to the incident. All in all, this was mundane, not catastrophe.Seoul’s response suggests the government wants to tell a different story. The PIPC investigation culminated in a $409 million fine—more than four times greater than th...