Loading story…
South Korean authorities attributed Coupang’s large-scale customer data leak to management and security control failures, not a sophisticated external cyberattack. Investigators said a former Coupang engineer who knew about weaknesses in the company’s authentication process gained unauthorized access beginning in April (after an earlier attempt in January) and maintained access until November, exploiting authentication vulnerabilities to access user accounts without proper login. Officials urged Coupang to remediate security weaknesses and asked police to investigate allegations that Coupang deleted some data despite an order to preserve it; Coupang said it is strengthening safeguards and claimed there was no evidence other parties accessed or viewed the data, and that the exposed data did not include payment or login information.
The incident affected roughly 33.7–34 million customers, with exposed data reported to include names, email addresses, phone numbers, shipping addresses, and some order history. The breach has escalated into a cross-border legal and political dispute: multiple U.S. investment firms (including Greenoaks, Altimeter, Abrams Capital, Durable Capital Partners, and Foxhaven Asset Management) filed notices seeking investor–state dispute settlement (ISDS) arbitration under the Korea–U.S. Free Trade Agreement, alleging South Korea’s investigation and enforcement actions were discriminatory and unusually severe compared with other domestic breach cases; reported measures included threats of major fines, operational suspension, and executive travel bans.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
The unauthorized activity persisted from April through November, and Coupang later said the former employee's program generated about 140 million queries during the incident.
According to the Science Ministry's findings, the former employee began sustained unauthorized access in April, generating fake login tokens with a stolen signing key to access customer accounts without proper authentication.
Foxhaven Asset Management, Abrams Capital, and Durable Capital Partners joined earlier investors seeking investor-state dispute settlement arbitration under the Korea-U.S. Free Trade Agreement over South Korea's handling of the Coupang breach probe. South Korea's Ministry of Justice said the filing triggered a mandatory 90-day consultation period before arbitration could proceed.
The ministry accused Coupang of deleting some data despite a preservation order, asked police to investigate the company, and said it planned an administrative fine of up to 30 million won for reporting the incident to authorities more than 53 hours after internal reporting.
South Korea's Science Ministry released initial findings concluding the breach was caused by management and security control failures, not a sophisticated cyberattack. Officials said about 33.7 million customers' personal data was exposed and criticized Coupang for failing to invalidate the former employee's signing key after departure.
South Korean officials said a former Coupang engineer first attempted to access customer accounts in January by exploiting weaknesses in the company's authentication process and misuse of a signing key.
In December, Coupang disclosed that a cyber incident lasting more than five months exposed personal information tied to nearly 34 million customers in South Korea, including names, shipping addresses, and contact details. The company said payment information and passwords were not exposed.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcedatabreaches.net
Open sourcetechcrunch.com
Open sourceteiss.co.uk
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Coupang, South Korea's largest e-commerce platform, confirmed a major data breach that exposed the personal information of approximately 33.7 million customers, representing a significant portion of the country's population. The breach, which was initially detected on November 18 with only 4,500 accounts affected, was later found to be far more extensive, involving names, email addresses, phone numbers, shipping addresses, and partial order histories. Coupang stated that payment card details and login credentials were not compromised. The unauthorized access reportedly began on June 24, originating from overseas servers, and was facilitated by weaknesses in Coupang's authentication key management, including the failure to rotate or revoke signing keys after responsible employees left the company. South Korean authorities, including the National Police Agency, Korea Internet & Security Agency, and the Personal Information Protection Commission, have launched investigations into the incident, focusing on Coupang's compliance with data protection obligations. The government convened an emergency meeting and announced plans for stricter oversight and potential sanctions if safety measure violations are confirmed. Coupang has since blocked the unauthorized access route, enhanced internal monitoring, and engaged external security experts. The company issued public apologies and is cooperating with authorities to prevent further harm, while also notifying affected customers and providing support channels for inquiries.
Jun 29, 2026
Coupang, South Korea’s largest online retailer, suffered a massive data breach that compromised the personal information of nearly 34 million customers. The breach, which was revealed in mid-November, led to the resignation of CEO Park Dae-jun, who cited a deep sense of responsibility for the incident and its aftermath. Coupang’s parent company appointed Harold Rogers as interim CEO, with a stated focus on restoring customer trust and stabilizing the organization. The breach has intensified scrutiny of cybersecurity practices in South Korea, a country already noted for frequent data security incidents. In response to the breach, Seoul Metropolitan Police cyber investigators raided Coupang’s headquarters, seizing devices and data to determine the cause and scope of the incident. Authorities believe the perpetrator was a Chinese former employee with privileged access, who allegedly used a stolen private encryption key to forge authentication tokens and access customer data. The incident has sparked political debate over the adequacy of South Korea’s data protection laws and raised concerns among investors, especially after it was revealed that senior executives sold shares in a preplanned sale shortly before the breach was publicly disclosed.
Jun 29, 2026
South Korea’s Personal Information Protection Commission imposed a record **624.6 billion won** fine on Coupang, plus **248 million won** on subsidiary Coupang Fulfillment Service, after a breach exposed personal data tied to roughly **34 million to 37.55 million people**. Regulators said the incident stemmed from weak security controls, including poor authentication key management and inadequate access restrictions, and that exposed data included names, email addresses, shipping addresses, phone numbers, and order histories. Authorities said the breach began in 2025 and persisted for months before discovery, making it one of the country’s largest retail-sector privacy incidents. The commission also cited Coupang for failures involving data destruction, breach notification, interference with the independence of its data protection officer, and obstruction of the investigation. Investigators identified the main suspect as a former Coupang IT employee, described in one report as a **43-year-old Chinese national**, who allegedly retained sensitive data on multiple hard drives and tried to destroy evidence by discarding a laptop in a river. Coupang said it plans to challenge the penalty, disputed aspects of the exposure, and maintained the stolen data was limited, deleted from recovered devices, and not shared onward.
Jun 29, 2026