Loading story…
Coupang, South Korea's largest online retailer, suffered a major data breach that exposed the personal information of 33.7 million customers. The breach was traced to a former developer, a Chinese national, who stole the data and attempted to extort the company by threatening to leak the information unless paid. After the breach was discovered, the perpetrator destroyed his laptop, disposed of it in a river, and fled the country. Coupang responded by hiring Mandiant, Palo Alto Networks, and Ernst & Young to assist with the investigation and digital forensics, and worked closely with the South Korean government to secure a confession and recover evidence.
In response to the incident, Coupang announced a $1.2 billion voucher program aimed at restoring customer trust, though critics have argued that the vouchers, redeemable only with Coupang, serve more as a marketing tactic than genuine compensation. The company publicly acknowledged the breach shortly after discovery and has been transparent about its cooperation with authorities and the steps taken to address the fallout. The investigation included the analysis of recovered computing devices and hard drives, which were handed over to government investigators for further examination.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
The breach and Coupang's response prompted congressional hearings and sustained public criticism over corporate responsibility, privacy protections, and the adequacy of compensation. Consumer organizations publicly challenged the company's handling of the incident.
Coupang unveiled a voucher-based compensation plan valued at about $1.2 billion for affected customers. Consumer groups and critics argued the offer functioned more as a marketing program than meaningful compensation because the vouchers were redeemable only on Coupang platforms and could require additional spending.
The breach triggered a leadership shakeup at Coupang's South Korean subsidiary, including the resignation of its CEO and the appointment of an interim leader. The change came as scrutiny intensified over the company's handling of the incident.
Coupang engaged Mandiant, Palo Alto Networks, and Ernst & Young to investigate and respond to the breach, while coordinating with the South Korean government. The company said its investigation concluded the leaker acted alone, deleted the data, and did not share it further.
After stealing the data, the former developer allegedly attempted to extort Coupang, tried to destroy evidence, and fled South Korea. Forensic work later supported the suspect's confession, and investigators recovered relevant hardware including a laptop retrieved from a river.
A former Coupang developer, identified as a Chinese national, exfiltrated customer data affecting 33.7 million people by using a stolen security key. Exposed data included names, email addresses, delivery addresses, and phone numbers; Coupang said payment card and login data were not compromised.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Coupang, South Korea’s largest online retailer, suffered a massive data breach that compromised the personal information of nearly 34 million customers. The breach, which was revealed in mid-November, led to the resignation of CEO Park Dae-jun, who cited a deep sense of responsibility for the incident and its aftermath. Coupang’s parent company appointed Harold Rogers as interim CEO, with a stated focus on restoring customer trust and stabilizing the organization. The breach has intensified scrutiny of cybersecurity practices in South Korea, a country already noted for frequent data security incidents. In response to the breach, Seoul Metropolitan Police cyber investigators raided Coupang’s headquarters, seizing devices and data to determine the cause and scope of the incident. Authorities believe the perpetrator was a Chinese former employee with privileged access, who allegedly used a stolen private encryption key to forge authentication tokens and access customer data. The incident has sparked political debate over the adequacy of South Korea’s data protection laws and raised concerns among investors, especially after it was revealed that senior executives sold shares in a preplanned sale shortly before the breach was publicly disclosed.
Jun 29, 2026
South Korean e-commerce giant Coupang suffered a major data breach after a former employee stole a security key and accessed the personal information of approximately 33.7 million customers. The perpetrator used both a PC and a MacBook Air to access customer records, including order histories and building access codes, and later attempted to destroy evidence by smashing the MacBook and throwing it into a river. Despite these efforts, investigators recovered the device and linked it to the accused through its serial number. Coupang worked with forensic experts and law enforcement to investigate the breach, and the company has faced criticism over its handling of the incident and the adequacy of its response. In response to the breach, Coupang announced a compensation plan totaling 1.69 trillion won (about $1.17 billion), offering purchase vouchers to affected customers, including those who closed their accounts after the incident. The company publicly acknowledged its responsibility and expressed regret for the distress caused, while also defending its cooperation with authorities and the thoroughness of its investigation. The compensation scheme, however, has drawn criticism for being limited to Coupang's own services, with some officials accusing the company of leveraging the crisis for business gain. The incident has led to executive changes within Coupang and increased scrutiny from government agencies and the public.
Jun 29, 2026
Coupang, South Korea's largest e-commerce platform, confirmed a major data breach that exposed the personal information of approximately 33.7 million customers, representing a significant portion of the country's population. The breach, which was initially detected on November 18 with only 4,500 accounts affected, was later found to be far more extensive, involving names, email addresses, phone numbers, shipping addresses, and partial order histories. Coupang stated that payment card details and login credentials were not compromised. The unauthorized access reportedly began on June 24, originating from overseas servers, and was facilitated by weaknesses in Coupang's authentication key management, including the failure to rotate or revoke signing keys after responsible employees left the company. South Korean authorities, including the National Police Agency, Korea Internet & Security Agency, and the Personal Information Protection Commission, have launched investigations into the incident, focusing on Coupang's compliance with data protection obligations. The government convened an emergency meeting and announced plans for stricter oversight and potential sanctions if safety measure violations are confirmed. Coupang has since blocked the unauthorized access route, enhanced internal monitoring, and engaged external security experts. The company issued public apologies and is cooperating with authorities to prevent further harm, while also notifying affected customers and providing support channels for inquiries.
Jun 29, 2026