Loading story…
Woowa Brothers, operator of South Korea’s food delivery platform Baedal Minjok (Baemin), disclosed a customer data leak after a criminal ring infiltrated an outsourced firm that managed its customer service center. Police and the company said a suspect posed as a new rider recruit, gained access to a customer’s personal information including a contact number and address, and allegedly obtained the data for a retaliation-for-hire request coordinated through Telegram.
Police said the suspects were apprehended shortly after authorities informed Woowa Brothers of the breach. The company reported the incident to the Personal Information Protection Commission, notified customers believed to be affected, and said it will terminate its partnership with the service provider while tightening internal controls over personal data handling. The case adds Baemin to a growing list of South Korean companies hit by customer data leaks, alongside recent incidents involving Coupang, SK Telecom, and Lotte Card.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Woowa Brothers publicly disclosed the customer data leak involving its Baedal Minjok platform, reported the case to the Personal Information Protection Commission, and notified likely affected customers. The company also said it would terminate its partnership with the service provider and strengthen internal controls.
According to police and the company, the suspects were apprehended shortly after the case was reported, and police notified Woowa Brothers about the data leak. The client behind the request was described as unidentified.
A member of a criminal ring allegedly posed as a new recruit at an outsourced customer service provider for Woowa Brothers and obtained a customer's personal information, including contact number and address. Police said the data was apparently sought for a retaliation-for-hire scheme coordinated via Telegram.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
South Korean authorities attributed Coupang’s large-scale customer data leak to **management and security control failures**, not a sophisticated external cyberattack. Investigators said a **former Coupang engineer** who knew about weaknesses in the company’s authentication process gained unauthorized access beginning in April (after an earlier attempt in January) and maintained access until November, exploiting authentication vulnerabilities to access user accounts without proper login. Officials urged Coupang to remediate security weaknesses and asked police to investigate allegations that Coupang deleted some data despite an order to preserve it; Coupang said it is strengthening safeguards and claimed there was no evidence other parties accessed or viewed the data, and that the exposed data did not include payment or login information. The incident affected roughly **33.7–34 million** customers, with exposed data reported to include **names, email addresses, phone numbers, shipping addresses, and some order history**. The breach has escalated into a cross-border legal and political dispute: multiple **U.S. investment firms** (including Greenoaks, Altimeter, Abrams Capital, Durable Capital Partners, and Foxhaven Asset Management) filed notices seeking **investor–state dispute settlement (ISDS)** arbitration under the **Korea–U.S. Free Trade Agreement**, alleging South Korea’s investigation and enforcement actions were discriminatory and unusually severe compared with other domestic breach cases; reported measures included threats of major fines, operational suspension, and executive travel bans.
Jun 29, 2026
Coupang, South Korea's largest e-commerce platform, confirmed a major data breach that exposed the personal information of approximately 33.7 million customers, representing a significant portion of the country's population. The breach, which was initially detected on November 18 with only 4,500 accounts affected, was later found to be far more extensive, involving names, email addresses, phone numbers, shipping addresses, and partial order histories. Coupang stated that payment card details and login credentials were not compromised. The unauthorized access reportedly began on June 24, originating from overseas servers, and was facilitated by weaknesses in Coupang's authentication key management, including the failure to rotate or revoke signing keys after responsible employees left the company. South Korean authorities, including the National Police Agency, Korea Internet & Security Agency, and the Personal Information Protection Commission, have launched investigations into the incident, focusing on Coupang's compliance with data protection obligations. The government convened an emergency meeting and announced plans for stricter oversight and potential sanctions if safety measure violations are confirmed. Coupang has since blocked the unauthorized access route, enhanced internal monitoring, and engaged external security experts. The company issued public apologies and is cooperating with authorities to prevent further harm, while also notifying affected customers and providing support channels for inquiries.
Jun 29, 2026
Coupang, South Korea’s largest online retailer, suffered a massive data breach that compromised the personal information of nearly 34 million customers. The breach, which was revealed in mid-November, led to the resignation of CEO Park Dae-jun, who cited a deep sense of responsibility for the incident and its aftermath. Coupang’s parent company appointed Harold Rogers as interim CEO, with a stated focus on restoring customer trust and stabilizing the organization. The breach has intensified scrutiny of cybersecurity practices in South Korea, a country already noted for frequent data security incidents. In response to the breach, Seoul Metropolitan Police cyber investigators raided Coupang’s headquarters, seizing devices and data to determine the cause and scope of the incident. Authorities believe the perpetrator was a Chinese former employee with privileged access, who allegedly used a stolen private encryption key to forge authentication tokens and access customer data. The incident has sparked political debate over the adequacy of South Korea’s data protection laws and raised concerns among investors, especially after it was revealed that senior executives sold shares in a preplanned sale shortly before the breach was publicly disclosed.
Jun 29, 2026