Coupang Breach Exposes 33.7 Million Accounts as South Korea Investigates Months of Unauthorized Access

Millions of delivery records exposed over several months

Coupang, South Korea's largest online shopping platform, has disclosed a data breach affecting 33.7 million customer accounts after unauthorized access apparently continued for months. Investigators believe the access began in late June through servers outside the country. The company detected unusual activity on November 18 and notified authorities within two days.

The exposed information includes names, mobile numbers, email addresses, delivery addresses and details of certain past orders. Coupang says payment card data, bank information and login credentials were not accessed. By December 1, 2025, police were examining the possible involvement of a former employee who was reported to have left South Korea, while regulators were investigating whether the company broke personal information protection rules.

The number of affected accounts is equivalent to more than half of South Korea's population. Daily shoppers, families and small businesses now face the possibility of fraud attempts built around information normally shared to receive a delivery. A message containing a real name, address or order detail can look convincing even when it comes from a criminal.

Coupang initially identified about 4,500 compromised accounts. That figure rose to 33.7 million as investigators examined more of its systems. The company has apologized, says it has blocked the suspected access route and has strengthened internal monitoring. The government has convened an emergency meeting and established a joint response involving public agencies and private specialists.

The investigation now spans several connected issues: how access continued for so long, whether someone retained privileges after leaving the company, whether server checks failed and why existing security certification did not prevent another incident.

How the breach grew from thousands to millions

Coupang's initial discovery in mid November concerned a relatively small group of accounts. Further forensic work, which involves examining system records and other technical evidence, revealed a much larger exposure involving delivery information.

The suspected access period stretches back to late June. Authorities say a weakness in how certain servers were verified may have allowed someone outside the company to extract information repeatedly without setting off immediate alarms. Server verification is the process of checking that a system requesting access is genuinely authorized to receive it.

The main stages identified by the company and officials are:

• Late June: Unauthorized access is believed to have begun through servers located outside South Korea.
• November 18: Coupang detected unusual activity, initially linked to about 4,500 accounts.
• Within two days of detection: The company notified authorities.
• As the investigation expanded: The number of affected accounts rose to 33.7 million, and the government organized a joint response.

Coupang says it blocked the suspected route, increased monitoring and began working with security specialists and law enforcement. The government launched a formal investigation within days of the initial report.

Investigators have not yet settled exactly how the suspected former employee obtained or retained access, or whether the server verification weakness was the route used. Those questions sit at the center of the technical and criminal inquiries.

Why names and order details can help scammers

Coupang says the exposed records contain the everyday information needed to deliver purchases: customer names, mobile numbers, email addresses, delivery addresses and parts of order histories. Its statement that financial information and passwords were not accessed narrows the immediate risks, but customers still face attempts to trick them into handing over money or account access.

Criminals can use contact information and purchase details to impersonate Coupang support staff, delivery companies or even a bank. A caller who knows what someone ordered may sound credible before asking for a payment, a password or a verification code.

Text message phishing, often called smishing, uses messages that appear to come from a trusted organization. A fake delivery update or account warning can send a customer to a false login page, persuade them to disclose a code used once to approve access, or lead them to install harmful software.

Order details make these approaches more personal. Instead of sending a vague warning, a scammer may refer to a purchase or delivery address that the recipient recognizes. Social engineering is the name for this kind of manipulation: the attacker persuades a person to do something that gives away information or control.

Leaked contact details can also support attempts to reset passwords. Customers should watch for password reset messages or verification prompts they did not request and check any account change inside the official app or website.

Police examine possible access by a former employee

Police have identified a suspect who is a former Coupang employee and a foreign national, according to officials familiar with the investigation. The individual is reported to have left South Korea. Investigators are examining whether the person exploited a gap in server verification or retained access after leaving the company.

Someone familiar with internal systems may know where valuable records are stored, which checks protect them and where monitoring is weaker. That makes the suspected role of a former employee particularly important to the inquiry.

Insider risk also includes mistakes and access that remains active after a person changes jobs or leaves an organization. A system token, for example, acts as a digital pass that lets software request information. If it remains valid after it is no longer needed, it can leave a route into company systems.

The safeguards under scrutiny include limiting access to the people and systems that need it, replacing and cancelling credentials promptly, recording activity continuously and detecting unusual behavior. Completing those steps when an employee leaves is often called offboarding.

Regulators have stressed the seriousness of the breach and promised a rapid response. The investigation will need to connect the suspected individual's actions with the technical weaknesses that may have made repeated access possible.

Government investigation brings the threat of sanctions

The Ministry of Science and ICT has set out its response to the exposure of contact information affecting millions of people. Its stated position on the investigation and possible penalties was:

It said a swift investigation will be conducted and strict sanctions imposed if violations are found.

The Personal Information Protection Commission is examining whether Coupang violated data protection rules. The joint government response brings together law enforcement and technical agencies, with public and private participants coordinating technical analysis, support for victims and regulatory action.

Coupang says it is cooperating fully. Alongside blocking the suspected access route and tightening monitoring, the company has urged customers to watch for impersonation attempts and use official communication channels.

Authorities are also reviewing whether industry guidance should be strengthened in areas such as server security, the removal of access when employees leave and the verification of requests for information. The focus extends beyond identifying a suspect to examining whether company controls were adequate.

Regulators have signaled that penalties will be strict if compliance failures are confirmed. The case follows a breach at a leading mobile operator earlier in the year that affected more than 23 million users and resulted in a record fine for violations of personal information laws.

Security certification faces renewed scrutiny

Coupang holds ISMS P, South Korea's national certification for information security and personal data protection. It received the certification in 2021 and renewed it in 2024. The company has nevertheless recorded several incidents since 2020 and has been fined for earlier violations.

ISMS P audits examine documented policies, processes and controls. Keeping those arrangements effective in everyday operations requires continuing attention to changing systems, staff access and unusual activity. Human mistakes, insider abuse and failures in live systems can occur between periodic reviews.

Critics argue that audits can place too much weight on paperwork and too little on testing whether controls work under pressure. Large platforms use many connected services, outside integrations and teams, making it difficult to maintain a complete picture of who can reach particular records.

Microservices, for example, divide a large platform into smaller services that communicate with one another. Each connection needs appropriate access checks. A weakness in one service, or in the way it recognizes another, can create a route to information elsewhere.

Long lasting access tokens, gaps in server authentication and incomplete connections between activity logs are among the practical weaknesses that periodic checklist reviews may miss. Bringing logs together matters because a suspicious pattern may become visible only when activity across several systems is examined at once.

Coupang's certification history, repeated incidents and earlier fines have added weight to public concern about whether previous promises to improve security have translated into effective protection.

How the case compares with earlier breaches

South Korea has experienced several major personal data breaches over the past two decades. In 2011, hackers stole information from around 35 million accounts at a major social network and portal. Coupang's 33.7 million affected accounts place the latest incident close to that earlier figure.

In 2014, credit card companies lost tens of millions of records, including resident numbers and card details. Other incidents affected online marketplaces and energy companies, while mobile carriers have reported breaches in recent years.

The Coupang breach exceeds the more than 23 million users affected by the leading mobile operator's incident earlier in 2025. Those cases involved different kinds of records, but both show the reach of a security failure at a service used by a large share of the country.

Coupang's case stands out for the combination of scale, the months before detection and the suspected involvement of someone familiar with its systems. Its earlier, smaller incidents add another layer to questions about corporate oversight and the enforcement of national privacy rules.

Other jurisdictions illustrate different approaches to penalties and prevention. The European Union's General Data Protection Regulation, known as GDPR, requires privacy protections to be built into systems, calls for breach reporting within 72 hours and allows fines of up to 4 percent of global revenue.

In the United States, the Federal Trade Commission has imposed large penalties on companies that mishandled personal information or misled consumers. Japan tightened rules under its Act on the Protection of Personal Information after major incidents, adding stronger internal access rules and audits.

South Korea's framework is widely regarded as strict. Repeated large breaches have nevertheless put pressure on enforcement, monitoring and prevention to keep pace with changing attack methods and risks involving insiders.

Practical steps for customers

Coupang customers should be especially careful with unexpected delivery notices, account warnings and calls claiming to offer assistance. The company says there is no evidence that payment information or passwords were exposed, while the contact and order information involved can still make impersonation convincing.

Customers can reduce their exposure to these attempts by taking several practical steps:

• Be cautious with unsolicited calls, texts and emails asking for payments, account details or verification codes.
• Open the official app or type the website address yourself instead of following links in delivery or account messages.
• Enable two factor authentication where available, adding another check when someone tries to sign in.
• Review recent orders and saved delivery addresses for changes you did not make.
• Use a password manager and avoid using the same password for shopping, email and banking accounts.
• Reject unexpected requests to install remote assistance software on a phone or computer.
• Contact support through the official app or website to check suspicious messages claiming to come from Coupang.

Remote assistance software can allow another person to see or control a device. A caller who presents it as necessary to fix an account problem may be trying to obtain access instead.

Anyone who believes their information is being misused should report the matter to authorities and their mobile operator. Keeping screenshots, the time a message arrived and the phone number involved can help investigators connect incidents and identify malicious websites or numbers that need to be blocked.

Costs extend beyond repairing the systems

Coupang faces scrutiny from regulators, customers and investors. The company is listed in the United States and operates at national scale in South Korea, making the handling of the breach a matter of corporate governance as well as technical repair.

Major breaches can bring spending on forensic investigations, identity protection services, system redesign and customer support. Regulatory action and legal claims can add further costs. For a shopping platform built on repeat purchases and customer loyalty, a loss of trust can last beyond the initial response.

Calls for accountability are already growing. Future filings and company briefings will likely focus on access management, the cancellation of credentials, server verification, the coordination of system logs and oversight of outside integrations.

Coupang's task is to explain how information remained accessible for months and how its changes will prevent a similar failure. Rebuilding trust will require continuing investment in staff, working procedures and technology, alongside cooperation with the criminal and regulatory investigations.

What to Know

• The breach exposed personal information linked to 33.7 million Coupang customer accounts.
• The affected records include names, mobile numbers, email addresses, delivery addresses and some order details.
• Coupang says payment card data, bank information and login credentials were not accessed.
• Unauthorized access is believed to have begun in late June. Coupang detected unusual activity on November 18 and notified authorities within two days.
• The initial estimate of about 4,500 compromised accounts expanded as investigators examined the breach.
• Police are investigating a former employee reported to have left South Korea.
• The government has established a joint response, and regulators have warned of strict sanctions if violations are found.
• Coupang says it blocked the suspected access route, strengthened monitoring and is cooperating with investigators.
• The incident has renewed scrutiny of ISMS P certification and the company's earlier security failures.
• Customers should verify unexpected messages through official channels and never disclose passwords or verification codes to unsolicited callers.