Former Coupang Employee

Profile narrative

The threat actor is publicly referenced as a former employee of Coupang and operates under the alias “Former Coupang Employee.”
No additional aliases or group names have been linked to this individual in open source reporting.
The actor’s prior affiliation with Coupang granted them legitimate internal access before the misuse occurred.
This insider status enabled the actor to exploit existing trust relationships within the corporate network.
No public evidence connects the actor to any other organization or prior cyber campaigns.

The intrusion began in late June 2025 when the actor abused weak management of authentication signing keys and inadequate access controls.
By leveraging these gaps, the actor gained unauthorized entry to systems storing customer personal information.
The actor used overseas servers as a pivot point to conceal the origin of the traffic and evade internal detection.
Approximately 33.7 to 37.5 million customer records were accessed, encompassing names, phone numbers, delivery addresses, email addresses, and order histories.
The breach remained undiscovered until mid‑November 2025, when internal monitoring flagged the anomalous activity.

Following detection, Coupang announced the distribution of roughly $1.17 billion in compensation vouchers to affected customers.
The company also confirmed that all stolen data had been recovered and that the intruder’s devices had been seized.
South Korea’s Personal Information Protection Commission imposed a record fine exceeding $400 million for the breach and related non‑consensual data collection.
Coupang’s leadership changed as a result, with CEO Park Dae‑jun resigning and Harold Rogers being appointed as interim chief executive.
The company has stated it will contest the fine imposed by the commission.

Incidents

Attributed incidents are available to members.