Fined $422M, Coupang Sparks US-Korea Clash
Seoul's record $422 million fine on Coupang draws Washington pushback, as lawmakers question whether Korea is treating the company fairly.
Masthead · Legal Affairs Writer
Washington, D.C. · Joined January 2026
Georgetown Law '18. Chose journalism over practice. Covers DOJ fraud cases, patent wars, and qui tam whistleblower suits. Washington, D.C.
Seoul's record $422 million fine on Coupang draws Washington pushback, as lawmakers question whether Korea is treating the company fairly.
The EU's largest Digital Services Act fine yet accuses AliExpress of giving moderators mere seconds to catch banned toys and cosmetics.
France ordered its internet providers to cut off Polymarket, citing hacked weather sensors and zero identity checks on French bettors.
Coca-Cola's Fairlife brand just became the 17th US cyberattack of 2026, and the SEC's four-day disclosure clock is already running.
20 state AGs told the OCC, FDIC and Fed to kill OppFi's and Enova's bank buys, calling the deals a blueprint for evading rate caps.
Two teens got 5.5 years for a £29M TfL hack, the UK's first conviction under a law meant for critical-infrastructure sabotage, prosecutors say.
DOJ charges a St. Petersburg trio who allegedly rented server space to ransomware gangs, no arrests, just a $10M bounty.
A credit union trade group wants the Fed's own 2023 debit-fee rewrite scrapped, not paused, amid ongoing litigation over the rule.
Three former iSun officers quietly put their spouses on payroll using PPP loan funds, and the SEC made all three pay six figures for it.
Bank trade groups say Oregon's new 36% interest rate cap breaks federal preemption law, and a Colorado court already ruled their way once.
Apple's trade-secret suit against OpenAI hit courts months after Musk's own case collapsed, and the two feuds are now colliding in public.
A ransomware negotiator sold out five clients to BlackCat hackers for a payoff. He got 70 months and a $10M asset seizure.
DigitalMint hired him to negotiate ransoms. He fed victims' insurance limits to BlackCat hackers and pocketed a cut of every payout.
An Armenian hacker living in Ukraine and Russia now faces 15 years after admitting his role in a $15 million Ryuk ransomware extortion ring.
OpenAI sat on 78 million searchable ChatGPT logs for two years while telling a federal judge the searches were impossible, NYT says.
A stepfather's suicide, 7,000 images, and weeks of stonewalling: an amended suit says xAI hid evidence from cops investigating its own AI.
Comcast complained the rule was burdensome. Now the FCC agrees, and ISPs can bury fees in one "up to" price.
Eight companies got FTC warning letters over questionable 'Made in USA' claims, the same playbook that cost TouchTunes $625,000 in April.
Texas AG Ken Paxton is investigating StubHub for cancelling World Cup tickets hours before kickoff, calling it possible ghost ticketing.
EPA wants to slash the chemical-accident rule a federal judge forced it to write in 2019, as weekly plant explosions and leaks keep piling up.
He flaunted diamond chains and Paris hotels online while still a minor. Now, at 19, the Scattered Spider hacker faces federal charges in Chicago.
EagleBank's compliance team flagged a check-kiting scheme in 2008. Executives overrode them anyway, and it cost $9.7M to make the DOJ go away.
JPMorgan wants a federal judge to erase the $4.2 million award a FINRA panel gave a broker fired over a $642 deli platter ordered for absent clients.
The SAFE Banking Act has cleared the House seven times without a Senate vote. Cannabis reclassification may finally change that math.
Roberts held Trump's Cook firing violated the for-cause bar and denied her due process, while the same court backed his FTC firing.
EU Directive 2025/516 targets up to €11B in annual VAT fraud, and CFOs who treat it as an IT project will solve compliance and nothing else.
Two critical CVEs hit the KEV catalog this week with June 28 deadlines: Cisco UCM is actively exploited, PTC's PLM suite is under attack.
Hackers drain $3M from under 15 Polymarket accounts via a compromised frontend vendor, prompting a full reimbursement pledge from the $9B platform.
Trump's 100% tariff threat explicitly supersedes existing trade deals, with France, Denmark, and Portugal already in the crosshairs.
Nine months after Russian hackers halted production at one of Britain's biggest employers, the £1.5B government bailout bill has a name attached.
Polish CBZC and FBI arrested four in a SIM-swap crypto theft ring facing 25 years; FBI involvement suggests U.S. victims and federal proceedings.
Former NJ AG's new firm just sued OpenAI and Microsoft on behalf of nearly 400 newspapers, and the DMCA claim may be the sharper weapon.
For the first time, EU cloud rules could bind AWS and Azure, even though neither company cleared the DMA's standard numeric thresholds.
Microsoft's RICO filing merged two separate malware families into one conspiracy; the takedown hit 326 servers and froze $47M in criminal crypto.
Alibaba sued the Pentagon in San Jose on June 23, claiming its Section 1260H designation violates due process, with a DoD contract ban due June 30.
OCC's Bank Secrecy Act rule for stablecoin issuers arrived the same week five agencies jointly proposed mandatory KYC for the same companies.
With 1,400+ Splunk instances exposed online, CISA just gave federal agencies three days to patch a 9.8-severity flaw attackers are already hitting.
CISA's hard patch deadline for an actively exploited Splunk RCE hits agencies that use the same platform to detect intrusions in the first place.
Three million Texas hunters and anglers had their driver's licenses and passport numbers exposed — and TPWD still won't name the vendor.
Shadowbyt3$ leaked Nintendo employee W-9s and bank statements after the company refused a $2M ransom demand routed through a WebMD subsidiary.
FTC's proposed consent order forces Aurobindo to sell four generics to rival Quagen Pharmaceuticals before its $250M Lannett acquisition can close.
Keir Starmer orders six platforms including TikTok and YouTube to block all under-16s by spring 2027, with AI chatbot age gates on top.
An Iowa IT worker kept Saydel School District's credentials after quitting, then spent 21 months deleting accounts and disrupting classrooms.
Google's own Gemini was the weapon of choice for a China-based phishing ring that caused $1.9B in losses. Now Google is the plaintiff.
Oracle's PeopleSoft had no patch for two weeks while ShinyHunters breached 100+ organizations, with 454,600 student records already leaked.
Oracle's PeopleSoft zero-day hit 100+ organizations, 68% of them universities, with student finance records now on a hacking group's leak site.
ShinyHunters confirms breaching 300 Oracle PeopleSoft instances at 100+ organizations, with zero-days in play and universities hit first.
CFTC's prediction market rule proposes a categorical bar on war and terrorism bets, citing assassination-plot conflicts of interest.
Qilin ransomware hit a few dozen organizations through a CVSS 9.3 Check Point VPN flaw before a patch existed. Agencies have until June 11.
Colorado's DIDMCA opt-out drew an amicus coalition of FDIC, OCC, 21 state AGs, and the U.S. Chamber against it in the Tenth Circuit.
House Democrats say DOGE's Social Security grab may be the largest breach in U.S. history, and Iran and China had a very bad quarter too.
The FCA froze a payments firm operating in the UK, US, and Spain over money-laundering gaps and appointed court managers; hearing is June 11.
Polyfill.io reactivated in late May, hitting Toshiba, Muji, and five others with rogue login prompts two years after a Chinese entity hijacked the CDN.
Darren Hughes offered free meth samples on Nemesis Market, then sold fentanyl to undercover agents five times in 2023. He got 26 years.
Barlow's qui tam suit alleges IBM concealed 56,000 APT 10 breaches from federal clients and didn't keep the logs to know what was taken.
Columbia's 2025 breach exposed 1.8M SSNs, and an undisclosed number of victims had no connection to the university or any warning it held their data.
New York's Champerty Fix Act cleared the Senate and faces an Assembly deadline this week, with hundreds of billions in sovereign debt at stake.
Louisiana is the 22nd state with a comprehensive privacy law, but CCPA-style thresholds and a narrower sensitive-data scope create compliance gaps.
After three years in the red, Indiana's $116M Farmers and Mechanics Federal Savings Bank now needs FDIC sign-off on every exec hire.
A PAN-OS authentication bypass rated medium on May 13 is now critical and actively exploited, with federal agencies ordered to patch by June 19.
LA Superior Court handed OppFi a clean win over DFPI's true lender attack on its FinWise Bank partnership, but DFPI has 60 days to appeal.
Charter turned down ShinyHunters' ransom on 42 million Salesforce records, and the gang posted 4.9 million customer accounts on the dark web.
One phished Carnival employee exposed 6 million records to ShinyHunters, who listed Carnival on a pay-or-leak portal weeks before disclosure.
A Google engineer bet $2.7M on Polymarket using confidential search rankings and won $1.2M, until Discord figured out who AlphaRaccoon was.
Tesla submitted 228 sworn declarations to defeat the case. Ninety-nine of them confirmed the n-word was heard at Fremont. Trial starts July 20.
A non-government UK visa portal exposed 100K passports on a public S3 bucket, then sent BakerHostetler instead of patching the server.
Dutch FIOD arrested two men who kept 800 servers running for Russia's cyber network even after EU sanctions targeted the infrastructure.
If Treasury acts on Moolenaar's COINS Act request, deals like BMS's $15.2B Hengrui partnership would need federal clearance before closing.
FDIC's third GENIUS Act NPRM adds AML/CFT rules to stablecoin issuers, completing a compliance stack that changes who can enter the market.
Trump Mobile confirmed a customer data exposure linked to a third-party provider, then said it's still weighing whether to notify those affected.
When Europol obtained First VPN's user database, it told every client they'd been identified. Now 25 ransomware gangs know their cover is gone.
TeamPCP stole 3,800 GitHub internal repos via a poisoned VS Code extension live for just 18 minutes, now demanding at least $50K for the data.
California's first-ever Yotta penalty is $1M, but the 18,000 California customers still waiting for Synapse restitution call it a rounding error.
TeamPCP breached GitHub via a poisoned VS Code extension, pulling approximately 3,800 internal repos now listed on criminal forums.
OCC's May 15 final rules preempt interest-on-escrow laws across 14 jurisdictions, but circuit splits with the First and Ninth keep the fight open.
UK Treasury plans to ease ringfencing rules, freeing £80 billion in lending capacity for banks that argued the post-2008 rules cost too much.
A CISA contractor disabled GitHub's secret scanning before publishing AWS GovCloud admin keys and plaintext passwords to a public repository.
NYC's largest public health system had fingerprints and palm prints stolen, covering 1.8M people, with no explanation for why it stored biometrics.
Federal judge fines Cliq $6.5M for violating its 2015 FTC consent order, far below the $52.9M sought, but no receiver and no industry ban.
Adani Green sold $750M in bonds while its founder personally orchestrated bribe payments to Indian officials, the SEC alleged in late 2024.
Judge Barrett called Peters a 'charlatan' who'd do it again. Colorado's governor cut her 9-year sentence anyway, after just 18 months.
NYDFS is telling NY lenders that disparate impact still applies, directly contradicting Trump's EO 14281 and the CFPB's Regulation B rewrite.
Jules v. Balazs locks federal courts onto post-arbitration jurisdiction for stayed FAA cases, closing the Badgerow gap businesses feared.
Three malicious node-ipc versions drain cloud keys, SSH creds, and CI/CD tokens via DNS; attacker hijacked an inactive npm maintainer's account.
Japanese startup Reqrea left 1 million hotel passports in a public S3 bucket anyone could read. Its investigation has no published timeline.
Drift and Kelp DAO lost nearly $600M in April. Cybersecurity experts now say the speed of those attacks is consistent with AI assistance.
Senate committee cleared the CLARITY Act; banks are already lobbying to gut the stablecoin yield provisions before the floor vote.
The FTC's $53,088-per-violation deepfake rule starts May 19, and compliance attorneys already know which way platforms will lean on this.
Crypto's first federal rulebook passed committee 15-9, but needs 60 Senate floor votes and must clear a Trump family conflict-of-interest fight.
Block reserved $240M for a DOJ settlement it actively disputes, having already paid $295M to state and federal regulators for Cash App.
The alleged 'Speedstepper' bought $1.7M in gold bars with Dream Market crypto proceeds. Now he faces 12 federal counts at up to 20 years each.
Jho Low, the 1MDB fugitive charged in the largest-ever FCPA case, petitioned DOJ for a pardon while his co-defendants serve prison time.
Nitrogen ransomware claims 8TB and 11M documents stolen from Foxconn, with Apple, Nvidia, and Intel design files allegedly in the haul.
The SECURE Data Act would replace the state privacy patchwork with one federal standard for businesses above $25M revenue and 200,000 consumers.
ICO cut South Staffordshire's £963,900 fine by 40%, yet the breach ran undetected for 20 months while Cl0p ransomware exfiltrated 664k records.
Instructure settled with ShinyHunters after a 275-million-record breach, but security researchers warn ransoms don't guarantee deleted data.
Judge Hoyt granted acquittal after DOJ left translators off the witness stand. Now the government takes its Sixth Amendment loss to the Fifth Circuit.
Payward already holds a Fed master account; an OCC trust charter would complete the picture, but BPI may sue to shut the whole pipeline down.
A German suspect rebuilt Crimenetwork within days of its 2024 shutdown, attracted 22,000 users and €3.6M, then got arrested in Mallorca.
Peter Williams, who ran L3Harris's hacking-tools unit, got a $10M restitution order Wednesday. Russian spies later used the stolen tools in Ukraine.
France has escalated its X content probe to a criminal case against Musk and Yaccarino, who could face indictment if they don't appear.
The CBLR's revised eligibility rules and recalibrated leverage ratio mean every community bank must decide by July 1 if it still qualifies.
Trump's 100% drug tariff has a two-tier problem: big pharma cut deals, small- and mid-sized drugmakers are still in the line of fire.
When U.S. companies thought they were hiring domestic IT workers, the paychecks landed in Pyongyang. Two Americans just learned the price.
Four Chime customers allege Iran-linked Team 313 stole Social Security numbers and account credentials; Chime says no member data was compromised.
A Latvian national drew 102 months for his role in a Conti offshoot's $16M ransomware spree, including leaking children's health data.
The Conti operator who threatened to leak stolen children's health records to extort payment just drew 102 months from DOJ's Criminal Division.
Edge's autofill keeps plaintext passwords in process memory, creating a dump-and-steal path that sidesteps both Windows Hello and DPAPI.
A USB drop test went viral in 2026 because employees plugged in the drives within hours, exposing a gap in phishing-focused security programs.
Virginia's class action bill looks like a consumer win, until you see where the $424 million goes. Mississippi would then stand alone.
A Telegram fraud ring called FEMITBOT is spoofing Apple, NVIDIA, and six other major brands to harvest deposits from fake crypto dashboards.
ShinyHunters claims 275 million student and teacher records stolen from Instructure's Canvas platform, hitting nearly 9,000 schools worldwide.
Microsoft's Defender antivirus flagged legitimate DigiCert root certificates as Trojan:Win32/Cerdigent.
A criminal threat actor hit Instructure, the company behind the Canvas learning management system, in a cyberattack disclosed this week.
The UK Serious Fraud Office secured a court-approved Deferred Prosecution Agreement with Ultra Electronics Holdings Ltd, a British manufacturer of…
The FCC voted unanimously Wednesday to tighten Know Your Customer rules for U.S. telecoms, closing a loophole dating to 1999 that let foreign companies…
A federal court sentenced Ryan Clifford Goldberg, 40, a former Sygnia incident response manager, and Kevin Tyler Martin, 36, a former DigitalMint ransomware…
DOJ sentenced two former cybersecurity professionals to four years each in federal prison Thursday for ransomware attacks they ran against U.S. companies in…
The Department of Justice sentenced Romanian national Thomasz Szabo, 27, to four years in federal prison Wednesday after he pleaded guilty to one count of…
On April 24, 2026, the Office of the Comptroller of the Currency issued an interim final rule and a companion order expressly preempting the Illinois…
Ukrainian cyber police, Lviv regional prosecutors, and the Security Service of Ukraine arrested three men on charges under Ukraine's Criminal Code Article…
Canada's 2026 Spring Economic Update, released Tuesday, proposes banning crypto ATMs nationwide.
DOJ charged Abraham Cigarroa Cervantes, former finance director of Stericycle's Latin America division, with two counts of conspiracy under the Foreign…
ShinyHunters claims it breached Udemy, one of the world's largest online learning platforms, and is threatening to publish 1.4 million customer and…
ShinyHunters, the extortion group behind a wave of Snowflake-linked breaches, has put Vimeo on a clock: pay up or face a public data dump by April 30.
Federal prosecutors charged a 19-year-old dual U.S.-Estonian citizen with wire fraud, conspiracy, and computer intrusion, alleging he's a prolific member of…
Evan Tangeman, 22, was sentenced to 70 months in federal prison for laundering at least $3.5 million tied to a $230 million Bitcoin heist, a RICO conspiracy…
ADT and the ShinyHunters extortion group are at a standoff today, with attackers threatening to publish 10 million customer records unless the home security…
Wisconsin Attorney General Josh Kaul filed complaints Thursday against Kalshi, Robinhood, Coinbase, Polymarket, and Crypto.
DOJ charged Army Master Sergeant Gannon Ken Van Dyke in the US District Court for the Southern District of New York with five counts: unlawful use of…
The House Energy and Commerce Committee's Republican data privacy working group filed H.R. 8413, the SECURE Data Act, on April 22.
The SEC issued SQM a subpoena in November 2023 under the Foreign Corrupt Practices Act, covering the Chilean miner's operations, compliance program, and…
The U.S. government charged Smartmatic in October 2025 with conspiracy to violate the FCPA's anti-bribery provisions, money laundering conspiracy, and money…
The European Securities and Markets Authority confirmed April 17 that MiCA's transitional grace period closes July 1 — any firm offering crypto-asset…
New York's Office of the Attorney General sued Coinbase and Gemini in state court Tuesday, charging both companies with operating illegal, unlicensed…
Two House members introduced the Payments Access and Consumer Efficiency (PACE) Act on April 21, giving nonbank payment service providers a federal path to…
California Attorney General Rob Bonta sued Amazon, alleging the company ran a years-long price-fixing scheme that lifted consumer prices across rival retail…
The SEC charged Key Tronic, a contract manufacturer of computer components and medical devices, along with two executives: Brett Larsen, the company's CFO…
CBP opened the CAPE portal today, placing 330,000-plus importers in line for a share of $166 billion in IEEPA duties, two months after the Supreme Court…
Following the Supreme Court's February ruling that invalidated tariffs collected under the International Emergency Economic Powers Act, U.S. Customs and…
Carl Zaglin, convicted of FCPA violations in the Southern District of Florida, has withdrawn his Second Motion for a New Trial — quietly collapsing a bid…
The OCC issued a consent order against The Federal Savings Bank of Chicago this month, alleging deceptive acts or practices in the bank's advertising to…
FinCEN published a Notice of Proposed Rulemaking under 31 U.S.C. § 5323 that would pay whistleblowers 10-30% of monetary sanctions collected in cases…
The Court of Appeals for the Federal Circuit on Thursday reinstated the $176.5 million verdict that Teva won in 2022, reviving its claim that Eli Lilly's…
If the Deterring American AI Model Theft Act passes, companies like DeepSeek, Moonshot, and MiniMax could face placement on the Commerce Department's Entity…
The FTC sued NERD Solutions Inc., ED REF Inc., and their operators Natalie Rodriguez and Pablo Ortiz in the U.S. District Court for the Central District of…
Judge David Hittner in the Southern District of Texas ordered Diego Bergonzi to forfeit $1,019,757 earlier this week, the exact proceeds Bergonzi pocketed…
Judge Howard Matz called it "an unusual and extreme picture of a prosecution gone badly awry.
The Seventh Circuit Court of Appeals ordered two former Commonwealth Edison executives released from federal prison hours after oral arguments on the FCPA's…
Judge Kenneth Hoyt of the U.S. District Court for the Southern District of Texas dismissed the FCPA indictment against Ramon Alexandro Rovirosa Martinez…
Treasury filed its first proposed rule under the GENIUS Act, 12 C.F.R. Parts 1520–1521, setting the standard that determines whether a stablecoin issuer…
The DOJ asked U.S. District Court Judge Kenneth Hoyt in the Southern District of Texas to stay his forthcoming dismissal order in the foreign bribery…
The FDIC this week released its proposed rule under the GENIUS Act, tying stablecoin issuance to reserve integrity, liquidity discipline and custodial…
The CFTC named five senior advisors to its Innovation Task Force on April 10, setting up a formal rule-writing process for crypto assets, artificial…
Denis Beau, first deputy governor of the Bank of France, told EU policymakers at the Eurofi High Level Seminar on March 26 that the Markets in Crypto-Assets…
A Phoenix federal judge on Friday temporarily blocked Arizona from enforcing its gambling laws against federally regulated prediction markets.
A Connecticut federal judge ruled Mallinckrodt's Irish unit can't escape a state price-fixing suit after a five-year jurisdictional delay.
The White House released its National Policy Framework for AI on March 20, 2026, calling on Congress to preempt state AI laws that "impose undue burdens.
FTC Chairman Ferguson warned PayPal, Stripe, Visa, and Mastercard that debanking customers on political grounds may violate the FTC Act.
Minnesota's attorney general is moving into a new phase of data privacy enforcement, signaling a shift in how the state approaches compliance obligations…
FinCEN and OFAC filed a joint proposed rule on April 8 to implement AML and sanctions compliance requirements for stablecoin issuers under the Genius Act.
FinCEN and OFAC issued a joint proposed rule on April 8 that would classify stablecoin issuers as financial institutions under the Bank Secrecy Act.
The Fed proposed replacing FedNow's two-bank transfer cap with an intermediary model, opening the platform to cross-border payments for the first time.
Acting Director Vought's plan would cut CFPB staff from 1,174 to 556 and reduce non-depository exams to 22 a year.
Trump's 100% Section 232 pharma tariffs exempt 13 drugmakers, generics, and trade-deal nations. Mid-sized biotechs are most at risk. Exemptions expire 2029.
The DOJ reversed course to back pharma in the 340B contract pharmacy dispute, leaving safety-net hospitals without a federal ally.
Trump signed an executive order imposing 100% tariffs on drug imports from countries without U.S. trade deals, effective within months.