South Korea imposed on Thursday a record US$409 million fine on e-commerce giant Coupang over a leak that exposed the data of more than 30 million customers, provoking ire from US lawmakers.

The move caps a months-long probe into the country’s largest online retail platform, which is incorporated in the United States.

Allegations of a massive data leak first surfaced in November, becoming an unexpected source of friction between Seoul and Washington.

“We have decided to impose a total of 624.68 billion won in fines … on Coupang for violating safety obligations and collecting personal data without legal grounds,” a Personal Information Protection Commission statement said.

“Inadequate basic safeguards, including poor management of authentication signing keys and lax access controls” resulted in the personal data of around 37.5 million users being exposed, the commission said.

Commission chair Song Kyung-hee told a press briefing on Thursday that the retail giant should have notified affected individuals within 72 hours.