South Korean regulators ordered U.S. retailer to recover laptop from Chinese river

A House Judiciary Committee report released Wednesday described how South Korean officials directed Seattle-based Coupang to recover a laptop from a river in Shanghai after a November data breach. The report said the company believed it had no choice but to hire scuba divers because it faced 40 investigations from 11 agencies, threats of travel bans for executives, and potential fines of up to 10 percent of global revenue.

Data breach and recovery operation The breach affected 33 million customers.

A Chinese national employee allegedly took data on 3,000 customers and fled to Shanghai, according to the report. Coupang contacted the employee, who turned over several devices but said a laptop had been thrown into a river. South Korean officials told the company its own staff must retrieve the device because Chinese law bars foreign intelligence agencies from operating there.

A Coupang representative traveled to Shanghai on Dec. 17 and received a desktop computer, four hard drives, a graphics card, and a signed confession. The next day, officials said the laptop still had to be recovered. Coupang hired a diving team to retrieve the device.

All materials were later handed to a South Korean official at the consulate in Shanghai.

Fines and regulatory pressure On June 11, South Korea’s Personal Information Protection Commission fined Coupang $410 million. The company said cybersecurity experts who reviewed the breach described it as minor and said no customers were harmed. Coupang’s interim CEO told committee officials he would not have authorized the operation without believing the company had a legal obligation to comply.