Coupang Inc.

Summary

Coupang was fined over $400 million by South Korean regulators after a data breach exposed the personal information of tens of millions of customers, including names, contact details, delivery addresses and order histories. The breach, traced to a former employee who accessed data through overseas servers, led to the exposure of roughly 34 million accounts and prompted the company to issue compensation vouchers totaling about $1.17 billion while an interim CEO took over leadership. Regulators also cited inadequate security controls, such as poor management of authentication keys and access controls, as contributing factors, and the company has indicated it will appeal the decision.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On June 24, 2025, Coupang’s data breach began when unauthorized access to customers’ personal information occurred via overseas servers, according to the company’s own statement to SecurityWeek. The incident was not discovered until November 18, 2025, when Coupang notified the Securities and Exchange Commission of the breach. At the time of the initial alert in November, Coupang told the BBC that it had been made aware of a breach affecting 4,500 customer accounts and immediately reported it to the authorities. Subsequent internal reviews revealed that nearly 34 million customer accounts, all located in South Korea, were likely exposed. A former employee was later identified by Coupang as the individual responsible for the intrusion, having obtained names, phone numbers, delivery addresses, and email addresses for up to 33 million accounts, along with order histories for some of those accounts. The compromised data included names, contact and delivery details, and order histories of customers, affecting more than 30 million individuals and representing over half of South Korea’s population of around 50 million.

Following a months‑long investigation, South Korea’s Personal Information Protection Commission (PIPC) announced on June 11, 2026, a fine of 423.6 billion won for the personal data breach and an additional 201 billion won for the non‑consensual collection of information, totalling 624 billion won (over $400 million). This penalty is the largest ever imposed by the PIPC for a data breach. The commission cited a lack of safeguards, including poor management of authentication signing keys and access controls, as the cause that led to the exposure of personal data for around 37.5 million users. Coupang stated that it deeply regretted the concern caused and said it would strengthen its security measures, but it also indicated that it planned to challenge the PIPC decision, asserting that its explanations and preventive actions were not sufficiently reflected in the commission’s ruling. The company, which is headquartered in the United States but derives most of its revenue from South Korea, said it expects the facts to be clarified through legal procedures after receiving the official resolution. Korean lawmakers have claimed that US representatives are exerting political pressure on the case, and reports suggest that American politicians have attempted to link the breach to bilateral US‑South Korea relations.

In the aftermath of the breach, Coupang’s chief executive officer Park Dae‑jun resigned, apologising for the incident, and the company’s chief administrative officer Harold Rogers was appointed interim CEO. To address the impact on customers, Coupang announced on December 31, 2025, that it would issue one‑time purchase vouchers worth 50,000 won (approximately $34.84) to each affected customer, beginning January 15, 2026, with the total compensation amounting to 1.685 trillion won (about $1.17 billion). The company said it aims to restore customer trust through this compensation plan and will practice a customer‑centric approach. Coupang’s founder Kim Bum‑seok confirmed that all stolen data had been recovered and that the intruder’s devices were seized, while the company maintained that the leaked data was limited to 3,000 cases and had not been circulated externally. Coupang also stated that it would strengthen its security measures to prevent future incidents.

Sources

Sources available to members: 3 sources.