South Korean e-commerce giant Coupang’s late 2025 data breach affected more than 200,000 users in Taiwan, prompting the Consumers’ Foundation, Chinese Taipei (CFCT) to urge the government to tighten cross-border data oversight and fast-track creation of an independent Personal Data Protection Commission. 

Investigations by the Digital Ministry found that, despite Coupang’s initial claim that no Taiwanese users were affected, a third-party digital forensics review ordered by the ministry confirmed the exposure of more than 200,000 local accounts. While Coupang said its Taiwan and South Korea databases were segregated, investigators discovered the company used the same backup encryption key across regions, effectively nullifying the separation and enabling unauthorized access.
The CFCT identified three core security failures: shared cross-region backup keys, lingering access privileges for former employees, and gaps in breach-notification procedures. Although firms must report breaches to the Digital Industry Agency within 72 hours, the foundation said enforcement against Coupang’s South Korean parent remains difficult under the current fragmented regulatory setup. “If you have a dedicated independent agency, it would be more professional in protection, inspections, audits and even penalties,” CFCT Secretary-General Chen Ya-ping said. “Right now, each sectoral regulator manages its own domain, so there’s no complete supervisory system, leading to inconsistent protection strength and widespread data leaks.”

The CFCT urged companies to store Taiwanese users' data locally, disclose breaches transparently, provide compensation, and improve staff cybersecurity training. They also recommended that consumers review privacy policies carefully and be aware that it may be harder to seek redress from operators without a physical presence in Taiwan.