Major retailers have increased spending on cybersecurity as a series of data breaches and hacking incidents heightened concerns over the protection of consumers’ personal and payment information.
Coupang invested 134.9 billion won ($86.6 million) in information security in 2025, according to filings uploaded to the Korea Internet & Security Agency website on Tuesday. The figure is up 51.6 percent from 89 billion won a year earlier, and marks the first time the company’s annual information security investment exceeded 100 billion won.
The figures cover only Coupang in Korea and do not include investments by the company’s subsidiaries or overseas affiliates.
Last year, Coupang made a total investment in information technology (IT) worth 2.57 trillion won, up 34.2 percent from 1.92 trillion won the previous year. Information security spending accounted for 5.2 percent of the company’s IT investment, up 0.6 percentage points from 4.6 percent a year earlier.
The company also expanded its dedicated information security work force. The company employed 370.1 full-time equivalent information security personnel as of last year: 204.8 in-house employees and 165.3 outsourced employees. The information security work force rose 75 percent from the previous year, far outpacing the company’s overall workforce growth of 7.4 percent during the same period.
Other major retailers also maintained or increased cybersecurity investment.
Emart raised its information security spending by about 33 percent to 8.1 billion won from 6.1 billion won a year earlier. GS Retail and CJ Olive Young increased their investments by more than 10 percent to 9.2 billion won and 5.4 billion won, respectively.
BGF Retail maintained investment at around 2.8 billion won over the past two years, while Musinsa increased spending by about 56 percent to 4.2 billion won last year from 2.7 billion won the previous year.
There were companies whose reported IT investment declined, but explained that the decrease reflected business restructuring rather than reduced cybersecurity spending.
“Last year’s information security investment fell to 6.9 billion won from 7.2 billion won the previous year, but it was because relevant personnel and investments of Lotte On’s mobile gift certificate business were transferred to Lotte Members,” said a source from Lotte Shopping.
A Gmarket representative also said spending appeared to decline because its payment business, Smile Payments, was spun off last year.
“Information security investment itself increased aside from that,” the source said.
The retail industry’s increased focus on cybersecurity follows a string of hacking incidents, with Coupang capturing headlines with a massive data breach that reportedly affected nearly all of its users.
“Retailers have a particularly large volume of business-to-consumer transactions, so even if they have not experienced a security incident, they seek to establish preventive systems to earn consumers’ trust,” said Youm Heung-youl, a professor of information security at Soonchunhyang University. “Along with expanding security investment, it is important to strengthen internal awareness and increase vigilance against personal data leaks.”
Experts also said the information security disclosure system should be made more transparent to ensure increased spending is actually directed toward cybersecurity.
“In some cases, companies simply reclassify items that should be counted as IT spending as information security investment,” said Kim Seung-joo, a professor at Korea University’s School of Cybersecurity. “Just because the reported amount has increased, it does not necessarily mean a company’s security capabilities have improved. Information security disclosures should undergo thorough verification just like corporate financial disclosures.”
BY NOH YU-RIM [lee.taehee2@joongang.co.kr]
