Log in Request a demo

Significant cyber incident

Coupang personal data breach, South Korea, 2025

Coupang, South Korea's largest online retailer, disclosed on 29 November 2025 that the personal data of about 33.7 million customer accounts had been exposed.

In short

Coupang, South Korea's largest online retailer, disclosed on 29 November 2025 that the personal data of about 33.7 million customer accounts had been exposed. A former employee used a stolen signing key to enter customer accounts without a normal login, and the access ran for months. South Korean investigators say the cause was weak basic security management. In June 2026 the privacy regulator imposed a record fine of 624.7 billion won.

Last updated October 2026

What happened

On 29 November 2025 Coupang confirmed that the personal data of 33.7 million customers had been compromised. The company had become aware of the incident on 18 November and first reported a leak of about 4,500 accounts to the Personal Information Protection Commission (PIPC) on 20 November. A later investigation found a far larger number, 33.79 million accounts according to the JoongAng Daily on 5 December 2025.

The Ministry of Science and ICT (MSIT) and a public-private joint investigation team published findings on 10 February 2026. They say a former employee stole the signing key of the user authentication system and used it to forge electronic passes, so the attacker could view customer pages without logging in. The team confirmed 33,673,817 name and email records leaked from one page. Names, phone numbers and delivery addresses were viewed from another page about 148 million times.

Coupang told the US Securities and Exchange Commission that about 33 million accounts were accessed but that the perpetrator saved limited data from about 3,000 accounts, which was deleted without being shared with a third party. The Korean government said this had not been verified. The PIPC’s own count, announced in June 2026, was 33,222,472 members plus at least 4,338,368 non-members whose details were stored as delivery recipients. Sources differ on when the access began (see How it worked).

The case was examined by the PIPC, MSIT, the Seoul Metropolitan Police Agency, prosecutors and the National Assembly. As of the sources opened (latest dated 2 July 2026), Coupang was challenging the PIPC decision and the police inquiry into possible obstruction was reported as continuing at its last report, 30 January 2026.

Timeline

  1. January 2025

    The PIPC says a test run used a stolen signing key on 95 accounts. MSIT says attack tests began the same month.

  2. 14 April to 8 November 2025

    MSIT says automated web crawling tools were used to take data on a large scale. A Korea Herald summary instead gives 24 June 2025 as the suspected start; sources differ.

  3. 16 and 25 November 2025

    The attacker sends Coupang two emails saying information has been exfiltrated (MSIT joint team).

  4. 18 November 2025

    Coupang becomes aware of the incident.

  5. 20 November 2025

    Coupang reports a leak of about 4,500 accounts to the PIPC.

  6. 21 November 2025

    Regulators order Coupang to preserve its access logs (PIPC). The PIPC later said Coupang deleted about six months of web logs six days afterwards.

  7. 29 November 2025

    Coupang publicly confirms that 33.7 million customers' data was compromised.

  8. 2 and 17 December 2025

    Lawmakers question the CEO and security chief on 2 December. The National Assembly committee holds a hearing on 17 December.

  9. 8 and 16 December 2025

    Prosecutors obtain an arrest warrant for the suspect, a former employee, on 8 December and send a mutual legal assistance request to China on 16 December.

  10. 10 December 2025

    The Korea CEO resigns and the parent company's general counsel takes over as interim head.

  11. 25 to 30 December 2025

    Coupang announces its own probe results (25 December) and files them with the SEC (29 December). The government says it has not verified them and, at a 30 December hearing, says over 33 million names and emails were leaked.

  12. 30 January 2026

    Police question the Korea CEO as a suspect in whether Coupang obstructed a government probe.

  13. 10 February 2026

    MSIT and the joint investigation team publish their findings.

  14. 10 and 11 June 2026

    The PIPC votes (10 June) and announces (11 June) a record fine of 624.7 billion won. Coupang says it will seek judicial relief.

How the attack worked

The main technical account comes from the MSIT joint investigation team (10 February 2026) and the PIPC decision as reported on 12 June 2026. Neither source describes malware. They describe abuse of a trusted key by someone who knew the system from inside.

Preparation

MSIT says attack tests began in January 2025, based on weaknesses the attacker knew about while employed at Coupang. The PIPC says the former employee left at the end of 2024, had developed the alternative authentication system and stole its signing key. A test run in January 2025 used the key on 95 accounts.

Bypassing login

Normally a user logs in and receives an electronic pass, and a gateway server checks that the pass is valid. The attacker used the stolen signing key to forge or alter these passes. Coupang did not detect or block access that used forged passes, and its check that a pass had been issued properly was inadequate.

Taking the data

MSIT says automated web crawling tools were used from 14 April to 8 November 2025, with 2,313 IP addresses. The delivery-address list page was viewed 148,056,502 times. The delivery-address edit page, which held entrance passwords, was viewed 50,474 times. The order list page was viewed 102,682 times. 33,673,817 name and email records came from the account edit page. The PIPC says traffic on these pages rose to many times its normal level and that Coupang noticed nothing until a customer forwarded one of the attacker’s emails.

Why it was possible

MSIT found that developers stored signing keys on laptops and that there was no key history management system. A ministry official said it was hard to view it as a sophisticated attack. The PIPC concluded the breach came from basic safety management failures. It is not confirmed whether the data was sent to external cloud servers overseas.

Sources differ on the start date. MSIT gives 14 April 2025 for the crawling. A Korea Herald summary gives 24 June 2025 as the suspected start. The PIPC (via The Record) describes a seven-month attack beginning with the January 2025 test run.

How the attack ran
  1. PrepareA former employee who knew the authentication system took its signing key
  2. Forge passesThe key was used to forge electronic passes and bypass login
  3. Crawl pagesAutomated tools viewed address, order and account pages
  4. Stay unseenMonths of abnormal traffic went undetected by Coupang
  5. ExtortEmails to Coupang on 16 and 25 November claimed data was taken

Who says who was behind it

No public attribution to a threat group. Official and press sources describe the actor as a former Coupang employee. The individual is not named here. A court arrest warrant was obtained on 8 December 2025 (Justice Minister, 7 January 2026), and as of 30 January 2026 Korean authorities had sought Interpol cooperation with no substantive response so far (Korea Herald).
Sources differ on the volume taken. Coupang told the SEC (reported 30 December 2025) that limited data from about 3,000 accounts was saved and deleted without being shared with a third party. The Ministry of Science and ICT said this had not been verified. MSIT said on 10 February 2026 that it was not confirmed whether data went to external servers overseas.

Impact

Accounts: Coupang said 33.7 million accounts were compromised (29 November 2025). The PIPC (June 2026) confirmed 33,222,472 members and at least 4,338,368 non-members. AP reports the PIPC saying more than 37 million people were exposed.

Data: names, emails, phone numbers and delivery addresses were viewed. MSIT says the delivery pages also hold details of family and friends. Coupang says its data did not include payment data, login data or customs numbers, and that 2,609 building entrance codes were among the data it found.

Harm to individuals: the joint team said on 10 February 2026 that no secondary damage attributable to the leak had been identified to date.

Fine: the PIPC imposed a record 624.7 billion won fine in June 2026, including a separate 201.1 billion won fine for collecting third-party browsing data of about 11.2 million users. Coupang's 8-K said the fines of about 410 million US dollars would be booked in its Q2 2026 results.

Compensation: Coupang announced vouchers worth 1.685 trillion won, 50,000 won per affected account holder.

Company: the Korea CEO resigned on 10 December 2025. A Korea Herald summary reports the share price fell from 28.16 dollars (28 November 2025) to 19.99 dollars (23 January 2026) and an investor lawsuit alleging weak cybersecurity and disclosure failures.

Government and regulator response

  • Coupang, 29 November 2025: confirmed the breach, apologized publicly (founder, 28 December) and later announced vouchers worth 1.685 trillion won.
  • MSIT and joint team, December 2025 to February 2026: a public-private team investigated. On 10 February 2026 it published findings and said MSIT would require Coupang to submit a recurrence-prevention plan, with corrective orders under the Information and Communications Network Act if needed.
  • National Assembly, 2 to 30 December 2025: committee questioning on 2 December, a hearing on 17 December and a joint hearing on 30 December where the science minister disputed Coupang’s 3,000 account claim.
  • Police and prosecutors: the Seoul Metropolitan Police Agency formed a task force in December 2025 and questioned the Korea CEO on 30 January 2026. Prosecutors obtained an arrest warrant on 8 December 2025 and asked China for legal assistance on 16 December.
  • PIPC, 10 and 11 June 2026: sanctioned Coupang and its logistics subsidiary, fined it 624.7 billion won in total and referred Coupang for criminal prosecution over deletion of logs.
  • Coupang, June 2026: said in an 8-K it would pursue judicial relief in the Seoul Administrative Court. Fines are not automatically stayed during an appeal.

Status: as of the latest source opened (AP, 2 July 2026) the appeal was announced. The sources opened do not give any court outcome. The Prime Minister’s Office and KISA pages could not be opened.

Lessons

  1. Protect signing keys like crown jewels

    MSIT found developers kept signing keys on laptops with no key history management. One stolen key let the attacker pass as any user.

  2. Remove insider knowledge when people leave

    The PIPC says the former employee built the authentication system and left with its key at the end of 2024. Rotate keys and secrets when such staff leave.

  3. Watch for abnormal volumes

    The PIPC says traffic on the affected pages rose to many times normal and requests used non-existent member IDs. Nobody noticed for months.

  4. Do not delete logs during an incident

    Regulators ordered logs preserved on 21 November 2025. The PIPC says about six months of web logs were deleted six days later, and 13% of attack period logs were lost.

  5. Report on time and report the real number

    Coupang first reported 4,500 accounts and the real figure was over 33 million. AP reports the PIPC saying it missed the 72-hour reporting window.

  6. Be careful with your own findings

    Coupang's own probe result of about 3,000 accounts was rejected by the government as unverified. Co-ordinate public statements with the regulator.

What to check in your own organization

  1. Signing key storage

    Find where token or session signing keys live. Check they are not on laptops and that every use and rotation is logged.

  2. Leavers and key rotation

    Check that secrets, keys and admin access held by departing developers are rotated when they leave.

  3. Forged token detection

    Check that gateways reject tokens not issued by the proper process, and alert on tokens that were never issued.

  4. Bulk page access alerts

    Alert on one account or IP range viewing very large numbers of address, order or profile pages, and on many requests with IDs that do not exist.

  5. Log retention and hold

    Check log retention periods and that auto-deletion can be paused at once when a regulator asks for preservation.

  6. Third-party data in profiles

    Check which pages show other people's data, such as address books of friends and family, and limit how much one login can reach.

  7. Notification clock

    Practise the 72-hour reporting rule. Know who files with the regulator and how to update the count as it grows.

Questions

How many people were affected by the Coupang breach?

Coupang said 33.7 million accounts on 29 November 2025. The PIPC confirmed 33,222,472 members and at least 4,338,368 non-members in June 2026, and AP reports it said more than 37 million people were exposed.

How did the attacker get in?

MSIT says a former employee stole the signing key of the authentication system and forged electronic passes to bypass login. It was not a malware attack according to the sources opened.

What data was taken?

Names, emails, phone numbers and delivery addresses were viewed, and order lists. Coupang says no payment data, login data or customs numbers were involved.

How much was Coupang fined?

The PIPC imposed a record 624.7 billion won in June 2026. That includes 201.1 billion won for a separate violation about third-party browsing data. Coupang says it will seek judicial relief.

Was a group blamed?

No. Sources describe a former employee and no group is attributed.

When did the access start?

Sources differ. MSIT says automated crawling ran from 14 April to 8 November 2025. A Korea Herald summary gives 24 June 2025. The PIPC describes a test run in January 2025.

Sources

  1. Government rebuts Coupang, says data breach far broader than claimed The Korea Herald, 30 Dec 2025
  2. Coupang files probe results with SEC as Korean gov't protests Korea JoongAng Daily, 30 Dec 2025
  3. Assembly's ICT committee sets date for hearing on Coupang data leak Korea JoongAng Daily, 5 Dec 2025
  4. After getting warrant for Coupang data breach suspect, prosecutors seeking China's help to extradite Korea JoongAng Daily, 7 Jan 2026
  5. Coupang data breach in 2 minutes (summary and timeline) The Korea Herald, 25 Jan 2026
  6. Coupang CEO questioned by police The Korea Herald, 30 Jan 2026
  7. Ministry of Science and ICT joint investigation findings (English report) Kyunghyang Shinmun, 10 Feb 2026
  8. Ministry of Science and ICT joint investigation findings (second report) Kyunghyang Shinmun, 10 Feb 2026
  9. South Korea hits Coupang with record $409 million fine over data breach The Record, 12 Jun 2026
  10. US-listed e-commerce giant vows to 'vigorously' seek judicial relief The Korea Herald, 12 Jun 2026
  11. South Korea disputes US congressional report claiming discrimination against Coupang Associated Press, 2 Jul 2026
  12. Coupang, Inc. Form 8-K (Item 1.05) and Form 8-K/A U.S. Securities and Exchange Commission (EDGAR)

Browse the threat library

Keep exploring

Knowledge Hub

Glossary term

Threat actor

A threat actor is an individual or a group that poses a threat to an organization or system.

Read more

Glossary term

Data breach

A data breach is an event where someone gets access to information they are not authorized to see, or where authorized users use it for a purpose they were not allowed.

Read more