Loading story…
Coupang, South Korea’s largest online retailer, suffered a massive data breach that compromised the personal information of nearly 34 million customers. The breach, which was revealed in mid-November, led to the resignation of CEO Park Dae-jun, who cited a deep sense of responsibility for the incident and its aftermath. Coupang’s parent company appointed Harold Rogers as interim CEO, with a stated focus on restoring customer trust and stabilizing the organization. The breach has intensified scrutiny of cybersecurity practices in South Korea, a country already noted for frequent data security incidents.
In response to the breach, Seoul Metropolitan Police cyber investigators raided Coupang’s headquarters, seizing devices and data to determine the cause and scope of the incident. Authorities believe the perpetrator was a Chinese former employee with privileged access, who allegedly used a stolen private encryption key to forge authentication tokens and access customer data. The incident has sparked political debate over the adequacy of South Korea’s data protection laws and raised concerns among investors, especially after it was revealed that senior executives sold shares in a preplanned sale shortly before the breach was publicly disclosed.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
9 events from the most recent confirmed update back to the earliest known activity.
South Korean regulatory bodies ordered Coupang to revise its terms of service and strengthen user protections following the breach. Officials also discussed tougher penalties and possible record-setting fines tied to the company's security practices.
Following public disclosure of the incident, South Korea saw hundreds of reports of phishing messages impersonating Coupang. The company also faced broader legal and political scrutiny, including reported class-action litigation and criticism of its liability practices.
Amid the fallout from the breach, Coupang CEO Park Dae-jun stepped down and issued a public apology. The company appointed Harold Rogers as interim CEO to lead the response and try to restore customer trust.
Seoul cyber investigators raided Coupang's headquarters and seized devices and data to determine the cause and route of the breach. The raid formed part of a broader criminal investigation into the exposure of 33.7 million customer records.
Investigators traced the breach to a 43-year-old former Coupang employee, a Chinese national alleged to have kept access after leaving the company. Authorities pursued a search warrant and examined how he retained privileged access.
After the breach was disclosed, South Korean police and other authorities began investigating the incident, including whether Coupang had been negligent in protecting customer data. The case also drew scrutiny from lawmakers and senior government officials.
Coupang did not detect the intrusion for nearly five months and discovered the breach on November 18, 2025. The incident was then revealed publicly, triggering a national backlash over the scale of the exposure.
On June 24, 2025, unauthorized access to Coupang systems began, exposing personal data from 33.7 million customer accounts. Reports say the attacker used a stolen private encryption key to forge authentication tokens and access internal systems through overseas servers.
A Chinese national who had worked at Coupang left the company in 2024 but allegedly retained access to internal systems and an internal authentication key, setting the stage for the later breach.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
govinfosecurity.com
Open sourcebankinfosecurity.com
Open sourcetechrepublic.com
Open sourcehackread.com
Open sourcebleepingcomputer.com
Open sourcecnbc.com
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Coupang, South Korea's largest e-commerce platform, confirmed a major data breach that exposed the personal information of approximately 33.7 million customers, representing a significant portion of the country's population. The breach, which was initially detected on November 18 with only 4,500 accounts affected, was later found to be far more extensive, involving names, email addresses, phone numbers, shipping addresses, and partial order histories. Coupang stated that payment card details and login credentials were not compromised. The unauthorized access reportedly began on June 24, originating from overseas servers, and was facilitated by weaknesses in Coupang's authentication key management, including the failure to rotate or revoke signing keys after responsible employees left the company. South Korean authorities, including the National Police Agency, Korea Internet & Security Agency, and the Personal Information Protection Commission, have launched investigations into the incident, focusing on Coupang's compliance with data protection obligations. The government convened an emergency meeting and announced plans for stricter oversight and potential sanctions if safety measure violations are confirmed. Coupang has since blocked the unauthorized access route, enhanced internal monitoring, and engaged external security experts. The company issued public apologies and is cooperating with authorities to prevent further harm, while also notifying affected customers and providing support channels for inquiries.
Jun 29, 2026
South Korean authorities escalated their response to a massive **Coupang** data breach that exposed personal information tied to about **34 million users**, with the Personal Information Protection Commission investigating possible violations and weighing penalties reportedly reaching **$770 million**. Regulators also warned the e-commerce company could face a **business suspension**, while police repeatedly searched company offices and examined whether the breach involved insider activity and possible overseas data leakage. One report said investigators identified a **former Chinese employee** as a suspect, while officials said no malware had been found and did not rule out a state-backed angle. The fallout reached Coupang's top leadership as the company's CEO resigned over the incident and police considered an **overseas travel ban** on senior executives. Investigators later questioned Coupang's interim chief for **12 hours** as part of the criminal probe, and South Korean police said they would continue examining management responsibility for the breach and the company's handling of user data. The case also drew political attention abroad after a U.S. lawmaker accused Korean regulators of taking **"discriminatory"** action against Coupang, underscoring how the breach has become both a major privacy enforcement case and a high-profile corporate governance crisis.
Jul 12, 2026
Coupang, South Korea's largest online retailer, suffered a major data breach that exposed the personal information of 33.7 million customers. The breach was traced to a former developer, a Chinese national, who stole the data and attempted to extort the company by threatening to leak the information unless paid. After the breach was discovered, the perpetrator destroyed his laptop, disposed of it in a river, and fled the country. Coupang responded by hiring Mandiant, Palo Alto Networks, and Ernst & Young to assist with the investigation and digital forensics, and worked closely with the South Korean government to secure a confession and recover evidence. In response to the incident, Coupang announced a $1.2 billion voucher program aimed at restoring customer trust, though critics have argued that the vouchers, redeemable only with Coupang, serve more as a marketing tactic than genuine compensation. The company publicly acknowledged the breach shortly after discovery and has been transparent about its cooperation with authorities and the steps taken to address the fallout. The investigation included the analysis of recovered computing devices and hard drives, which were handed over to government investigators for further examination.
Jun 29, 2026