Coupang Data Breach Exposes 33.7 Million Customer Accounts
Coupang CEO Park Dae-jun apologized after a massive data breach exposed personal information from 33.7 million accounts, prompting a South Korean government emergency investigation.
South Korean e-commerce giant Coupang confirmed a massive data breach that exposed the personal information of 33.7 million customer accounts, nearly its entire user base. The breach occurred between June 24 and November 8, 2025, through overseas servers. Leaked data includes names, email addresses, phone numbers, shipping addresses, and order histories, though payment details and login credentials remained secure.
CEO Park Dae-jun issued a public apology on November 30, stating the company will not evade responsibility. The company discovered the leak on November 18 and reported it to authorities. While Coupang listed the suspect as unidentifiable in police filings, reports suggest a former employee of Chinese nationality may be responsible. The Seoul Metropolitan Police Agency is currently tracking the internet protocol address used in the breach.
President Lee Jae Myung ordered a swift investigation and criticized the company for failing to recognize the intrusion for five months. The Ministry of Science and ICT confirmed the attacker exploited an authentication vulnerability and an electronic signature key to gain access without a normal login process. The government has convened an emergency ministerial summit and launched a joint public-private task force to investigate potential safety rule violations and state-aligned hacking entities.
The Personal Information Protection Commission is investigating whether Coupang neglected mandatory security obligations regarding encryption and access control. The company faces potential fines exceeding 1 trillion won, or 3 percent of total revenue. Regulators and the Korea Internet & Security Agency have warned affected users about potential phishing scams.
