Coupang Data Breach Attributed to Insider Exploiting Authentication Flaws

South Korean authorities attributed Coupang’s large-scale customer data leak to management and security control failures, not a sophisticated external cyberattack. Investigators said a former Coupang engineer who knew about weaknesses in the company’s authentication process gained unauthorized access beginning in April (after an earlier attempt in January) and maintained access until November, exploiting authentication vulnerabilities to access user accounts without proper login. Officials urged Coupang to remediate security weaknesses and asked police to investigate allegations that Coupang deleted some data despite an order to preserve it; Coupang said it is strengthening safeguards and claimed there was no evidence other parties accessed or viewed the data, and that the exposed data did not include payment or login information.

The incident affected roughly 33.7–34 million customers, with exposed data reported to include names, email addresses, phone numbers, shipping addresses, and some order history. The breach has escalated into a cross-border legal and political dispute: multiple U.S. investment firms (including Greenoaks, Altimeter, Abrams Capital, Durable Capital Partners, and Foxhaven Asset Management) filed notices seeking investor–state dispute settlement (ISDS) arbitration under the Korea–U.S. Free Trade Agreement, alleging South Korea’s investigation and enforcement actions were discriminatory and unusually severe compared with other domestic breach cases; reported measures included threats of major fines, operational suspension, and executive travel bans.