Loading story…
Coupang, South Korea's largest e-commerce platform, confirmed a major data breach that exposed the personal information of approximately 33.7 million customers, representing a significant portion of the country's population. The breach, which was initially detected on November 18 with only 4,500 accounts affected, was later found to be far more extensive, involving names, email addresses, phone numbers, shipping addresses, and partial order histories. Coupang stated that payment card details and login credentials were not compromised. The unauthorized access reportedly began on June 24, originating from overseas servers, and was facilitated by weaknesses in Coupang's authentication key management, including the failure to rotate or revoke signing keys after responsible employees left the company.
South Korean authorities, including the National Police Agency, Korea Internet & Security Agency, and the Personal Information Protection Commission, have launched investigations into the incident, focusing on Coupang's compliance with data protection obligations. The government convened an emergency meeting and announced plans for stricter oversight and potential sanctions if safety measure violations are confirmed. Coupang has since blocked the unauthorized access route, enhanced internal monitoring, and engaged external security experts. The company issued public apologies and is cooperating with authorities to prevent further harm, while also notifying affected customers and providing support channels for inquiries.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
Subsequent reporting said the breach may have been enabled by failures to rotate or revoke authentication signing keys after an employee's departure. The allegations sharpened scrutiny of Coupang's offboarding, access control, and key management practices.
In the aftermath of the public disclosure, affected users filed lawsuits and officials discussed stronger sanctions. Reports said Coupang could face major regulatory penalties, potentially including a record fine if violations of data protection rules are confirmed.
On 2025-12-01, Coupang publicly confirmed a massive data breach affecting about 33.7 million customer accounts, roughly 65% of South Korea's population. Exposed data included names, email addresses, phone numbers, shipping addresses, and partial order history, while passwords and payment card data were reportedly not compromised.
Initial investigations identified a former Chinese Coupang employee, reportedly tied to authentication systems, as the main suspect. Multiple reports said the case appeared to be an insider-driven breach rather than malware-based intrusion.
Following disclosure to regulators, South Korean authorities including the Personal Information Protection Commission, police, and KISA opened an investigation, reviewed server logs, and tracked the suspect's IP activity. An emergency government meeting was also convened in response to the scale of the incident.
After discovering the breach, Coupang blocked the unauthorized access path, increased monitoring, and hired an independent security firm to investigate. The company also began notifying affected users and warning them about possible phishing attempts.
Coupang discovered the incident on 2025-11-18 and reported it to relevant South Korean authorities shortly afterward. The company began internal response actions after identifying the unauthorized access.
Coupang later determined that unauthorized access to its customer database started on 2025-06-24. Reports indicate the access may have relied on an authentication key that remained active after a former employee left the company.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
11 references tracked. Mallory keeps watching after this page renders.
csoonline.com
Open sourcesecurityonline.info
Open sourcesecurityaffairs.com
Open sourcegovinfosecurity.com
Open sourcetherecord.media
Open sourcedatabreaches.net
Open sourcebleepingcomputer.com
Open sourcecio.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Coupang, South Korea’s largest online retailer, suffered a massive data breach that compromised the personal information of nearly 34 million customers. The breach, which was revealed in mid-November, led to the resignation of CEO Park Dae-jun, who cited a deep sense of responsibility for the incident and its aftermath. Coupang’s parent company appointed Harold Rogers as interim CEO, with a stated focus on restoring customer trust and stabilizing the organization. The breach has intensified scrutiny of cybersecurity practices in South Korea, a country already noted for frequent data security incidents. In response to the breach, Seoul Metropolitan Police cyber investigators raided Coupang’s headquarters, seizing devices and data to determine the cause and scope of the incident. Authorities believe the perpetrator was a Chinese former employee with privileged access, who allegedly used a stolen private encryption key to forge authentication tokens and access customer data. The incident has sparked political debate over the adequacy of South Korea’s data protection laws and raised concerns among investors, especially after it was revealed that senior executives sold shares in a preplanned sale shortly before the breach was publicly disclosed.
Jun 29, 2026
South Korean authorities attributed Coupang’s large-scale customer data leak to **management and security control failures**, not a sophisticated external cyberattack. Investigators said a **former Coupang engineer** who knew about weaknesses in the company’s authentication process gained unauthorized access beginning in April (after an earlier attempt in January) and maintained access until November, exploiting authentication vulnerabilities to access user accounts without proper login. Officials urged Coupang to remediate security weaknesses and asked police to investigate allegations that Coupang deleted some data despite an order to preserve it; Coupang said it is strengthening safeguards and claimed there was no evidence other parties accessed or viewed the data, and that the exposed data did not include payment or login information. The incident affected roughly **33.7–34 million** customers, with exposed data reported to include **names, email addresses, phone numbers, shipping addresses, and some order history**. The breach has escalated into a cross-border legal and political dispute: multiple **U.S. investment firms** (including Greenoaks, Altimeter, Abrams Capital, Durable Capital Partners, and Foxhaven Asset Management) filed notices seeking **investor–state dispute settlement (ISDS)** arbitration under the **Korea–U.S. Free Trade Agreement**, alleging South Korea’s investigation and enforcement actions were discriminatory and unusually severe compared with other domestic breach cases; reported measures included threats of major fines, operational suspension, and executive travel bans.
Jun 29, 2026
South Korea’s Personal Information Protection Commission imposed a record **624.6 billion won** fine on Coupang, plus **248 million won** on subsidiary Coupang Fulfillment Service, after a breach exposed personal data tied to roughly **34 million to 37.55 million people**. Regulators said the incident stemmed from weak security controls, including poor authentication key management and inadequate access restrictions, and that exposed data included names, email addresses, shipping addresses, phone numbers, and order histories. Authorities said the breach began in 2025 and persisted for months before discovery, making it one of the country’s largest retail-sector privacy incidents. The commission also cited Coupang for failures involving data destruction, breach notification, interference with the independence of its data protection officer, and obstruction of the investigation. Investigators identified the main suspect as a former Coupang IT employee, described in one report as a **43-year-old Chinese national**, who allegedly retained sensitive data on multiple hard drives and tried to destroy evidence by discarding a laptop in a river. Coupang said it plans to challenge the penalty, disputed aspects of the exposure, and maintained the stolen data was limited, deleted from recovered devices, and not shared onward.
Jun 29, 2026