Coupang Faces Probe and Possible Trillion Won Fine After Breach Exposes 33.7 Million Accounts

Months of unnoticed access put millions of customers at risk

About 33.7 million customer accounts at Coupang, South Korea's largest online retailer, were exposed in a data breach that went unnoticed for nearly five months. As of December 2, 2025, police and privacy authorities were investigating how the intrusion happened, while President Lee Jae Myung was demanding tougher penalties for companies that fail to protect personal information.

Coupang says it detected unauthorized access on November 18 and reported it to authorities. Later checks indicated that the intrusion likely began on June 24 through servers located overseas. Names, email addresses, phone numbers, shipping addresses and portions of order histories were exposed. The company says payment details and passwords were not accessed.

The breach is described as South Korea's largest in more than a decade. The number of affected accounts is roughly equivalent to two thirds of the country's population, illustrating the reach of a platform used by millions of households for everyday shopping and deliveries.

The financial stakes could reach hundreds of billions of won or potentially exceed one trillion won. Under the Personal Information Protection Act, companies that fail to implement adequate safety measures can face an administrative fine of up to 3 percent of annual revenue. The calculation for Coupang would depend on the revenue base regulators use.

Coupang has apologized, says it is cooperating with investigators and has blocked the route used to gain access. The immediate concern for customers is that exposed contact details and delivery information could help criminals create convincing fake messages, calls and emails. Police, the Korea Internet and Security Agency (KISA), and the Personal Information Protection Commission (PIPC) have launched investigations.

How the intrusion unfolded

June 24 is the suspected starting point for the unauthorized access. Investigators are tracing network activity and examining how Coupang's systems checked whether someone seeking internal access had permission to do so. The use of overseas infrastructure is also part of the inquiry.

Early findings point to weaknesses in authentication controls, the checks that allow a system to recognize an authorized user or service. According to officials briefed on the case, an authentication key associated with a former employee remained active after that person left the company.

Police are examining whether a former developer, reported to be a Chinese national now abroad, misused credentials or signature keys that should have been revoked. Investigators are reviewing whether those remaining permissions allowed access to customer information over several months.

The main dates in the case are:

• June 24: Unauthorized access is believed to have begun through overseas servers.
• November 18: Coupang says it detected the access and reported it to authorities.
• By December 2: The breach had been found to involve about 33.7 million customer accounts, and investigations into technical failures and legal compliance were under way.

Coupang says it notified KISA, the PIPC and the National Police Agency. It is sending alerts to affected users, has increased monitoring and has brought in independent security experts to assist with its response and repairs.

Government ministries have formed a joint team to establish the chain of events and determine whether required safeguards were in place. Its work includes examining possible violations of personal information protection rules. No final finding on responsibility, fine or timetable for completing the investigation had been given.

Why an old access key can cause so much damage

Modern online platforms use keys and tokens to let staff and computer services carry out specific tasks. A key works like a digital pass: the system checks it and grants the permissions associated with it. A signature key helps a system verify that a request is authorized.

A key that remains valid after an employee leaves can continue to open the same digital doors. Investigators in the Coupang case are examining whether credentials that should have been cancelled were used to move quietly through systems and reach large quantities of customer information.

Companies can reduce this risk by limiting access to the minimum needed for a job, an approach known as least privilege. They also need to cancel permissions promptly when someone leaves or changes roles, and regularly replace keys so that the same credential does not remain useful for a long time.

Keys with long lifespans are risky because a single missed cancellation can leave access available for months. Monitoring matters too: unusual requests for customer records should trigger checks before an intruder has time to collect a large amount of information.

Coupang's case puts both controls under scrutiny. Investigators are looking at whether access should have ended when the former employee departed and why the activity continued from late June until November without being noticed.

President Lee demands stronger accountability

President Lee Jae Myung has called the breach a wake up call for privacy protection and directed officials to prepare stricter penalties. The presidency convened senior officials and ordered proposals to strengthen consumer protection as the incident became a national concern.

The Ministry of Science and ICT, the PIPC and police are conducting a joint probe covering technical forensics and compliance with data safety laws. Technical forensics involves examining records of computer activity to reconstruct how access occurred and what information was reached.

At a cabinet meeting, Lee criticized the gap between the suspected start of the intrusion and its discovery. He called for faster accountability and a change in how large companies treat information entrusted to them by customers.

Lee, South Korea's president, said the failure to detect the intrusion showed that attitudes toward protecting personal data needed to change:

It is astonishing that Coupang did not even detect the breach itself for five months from when the incident first started. The wrong practice and the idea of not giving necessary care for personal data protection, which is a key asset in the age of artificial intelligence and digitalisation, must be completely changed.

The government's response extends beyond identifying who accessed the records. Officials are also examining whether Coupang's internal safeguards met its legal duties and whether existing sanctions give large companies sufficient reason to prioritize privacy protection.

How a fine could reach one trillion won

The Personal Information Protection Act requires companies to protect personal data through appropriate technical and administrative measures. Failures that lead to leaks can result in corrective orders, administrative fines and claims for damages.

The current maximum administrative fine is 3 percent of revenue when regulators find a failure to implement adequate safety measures. Coupang reports annual sales of tens of billions of dollars. Applying 3 percent to a revenue base of that size could produce a penalty worth hundreds of billions of won, potentially exceeding one trillion won at recent exchange rates.

The possible trillion won figure is a ceiling scenario tied to the revenue calculation and the findings of the investigation. Regulators must determine the relevant revenue base and assess any failures before deciding a penalty.

Authorities are reviewing punitive damages rules and whether penalties should increase for repeated failures or breaches affecting large numbers of people. Punitive damages are intended to punish serious misconduct, rather than simply repay a person for a loss.

New proposals could increase liability where there is serious harm or repeated negligence. Officials are also evaluating tighter deadlines for reporting breaches, mandatory testing of access controls and stronger evidence that companies manage keys properly and cancel access when staff leave or change roles.

Law firms are preparing class action suits, creating another potential cost for Coupang alongside any regulatory penalty. Compensation, technical repairs and other work needed to address the breach could also produce substantial costs concentrated around the incident.

What customer information was exposed

Coupang says the exposed information consists of contact details, delivery details and some order histories. The affected fields include:

• Full names.
• Email addresses.
• Mobile and other phone numbers.
• Shipping addresses.
• Portions of order histories.

The company says it has no evidence that credit card numbers, bank details or passwords were compromised. Its findings put the immediate customer risk mainly in targeted scams rather than direct theft using exposed payment credentials.

A criminal who knows someone's name, address and recent order details can make a fake delivery message sound genuine. The message might claim that a parcel needs an additional payment or that the customer must confirm information before receiving it. That familiarity can persuade a recipient to click a malicious link or disclose payment details.

KISA has issued public advisories warning people to watch for voice calls, texts and emails appearing to come from Coupang or courier services. It has advised consumers to avoid links in unsolicited messages that might exploit the leaked information.

People who depend on delivery notifications in daily life may find these attempts particularly convincing. Checking an order through the official app or website gives customers a way to confirm a message without following the link it contains.

Practical steps for affected customers

Customers receiving an unexpected message about an order or delivery problem should open Coupang's official app or website directly and check the notification there. An accurate name or address in a message is a reason to verify it carefully.

Coupang says it is notifying affected users, while authorities are warning about impersonation attempts. Customers can take the following steps to reduce the chance that leaked contact information leads to further harm:

• Avoid clicking links in unexpected emails or texts, and treat unsolicited calls about deliveries with caution.
• Enable verification in two steps wherever it is available. The extra login check can limit damage if other information is misused.
• Review recent orders and account activity, and report anything unfamiliar to customer support.
• Be wary of demands for payment to resolve a delivery problem. Reputable platforms do not ask customers to provide card details by text or phone.
• Use a password manager and a different password for each service to reduce risks associated with password reuse.
• Contact authorities if identity information appears to be misused, and request documentation from the company for any necessary reports.

These precautions address different risks. Verification in two steps strengthens account access, while checking delivery claims through the app helps customers avoid being persuaded to send money or information to an impersonator.

Coupang says it has strengthened internal monitoring and engaged independent experts after closing the access route. Its response includes both notifying customers and examining the systems that allowed the intrusion.

Coupang's scale increases the business stakes

Coupang had nearly 25 million active users in recent quarters and has expanded beyond online shopping into rapid grocery delivery, logistics and streaming. It also operates services in Japan and Taiwan.

The company says there is no evidence that its Taiwan unit or other affiliated services outside South Korea were affected. The domestic exposure is nevertheless extensive because Coupang handles information used for purchases and deliveries across so many households.

Coupang's shares fell as the size of the breach became public and police confirmed they were tracing IP addresses and reviewing technical vulnerabilities. An IP address identifies a connection on a network and can help investigators reconstruct where access came from.

Customer departures are expected to be limited because of Coupang's strong market position. Even if most customers continue shopping, compensation, possible penalties and the work required to address the incident could create large costs.

The revenue effect and the expense of resolving the breach are separate business concerns. Continued sales would help maintain the company's operations, while a major fine or compensation bill could still impose a substantial financial burden.

Coupang's market strength also makes the investigation important beyond its own balance sheet. The response will show how authorities apply existing privacy duties to one of the country's largest online platforms while considering stronger rules for other companies.

Earlier breaches add pressure for change

South Korea has experienced other major cyber incidents during the year. SK Telecom faced a large penalty after a leak affecting tens of millions of subscribers. A breach at Lotte Card also highlighted the attraction to criminals of companies holding detailed identity and purchase information.

Those cases preceded the Coupang breach and created a tougher backdrop for regulatory action. The PIPC recently imposed a record fine on a telecom operator following a breach that went unnoticed for years.

Officials have said repeated large leaks since 2021 point to weaknesses in personal information protection. In Coupang's case, investigators are assessing whether internal oversight and access controls fell short despite substantial spending on security and information technology.

Large data stores, complex systems and pressure to move quickly in competitive online markets can make oversight difficult. Companies may depend on many internal and external developers and numerous services that communicate with one another. Keys and tokens can accumulate, permissions may remain broader than necessary, and credentials may fail to expire on schedule.

A single key that has not been cancelled or a server configured incorrectly can then provide a route into customer records. Security spending needs to be supported by daily practices such as replacing keys, checking access records and tracking credentials from creation through cancellation.

Other platforms have begun internal security checks and audits. The discussion also extends to engineering teams working across borders, where data is stored and whether companies with overseas development hubs need tighter controls over domestic customer information.

What regulators will examine next

Investigators must establish how the access occurred, which safeguards were in place and whether Coupang met its obligations under personal information protection law. The inquiry combines examination of computer activity with review of the company's management of permissions and security responsibilities.

The government has ordered a review of punitive damages and penalties, increasing pressure for changes beyond this case. Proposals concerning reporting deadlines, testing access controls and documenting key management remain under consideration.

For large platforms, the practical measures identified by the incident include giving keys short lifespans, limiting permissions to the minimum necessary and automatically cancelling access when employees depart or change roles. Detection systems should also flag unusual requests involving customer databases.

Periodic internal exercises that simulate attacks, often called red team tests, and independent reviews can help find weaknesses before criminals use them. Regulators are likely to expect visible progress on these controls as companies carry out repairs.

For customers, the immediate task is simpler: verify unexpected delivery claims through official channels and remain alert to messages that use accurate personal details. For Coupang, the central challenge is to account for months of unnoticed access while dealing with investigations, possible litigation and the cost of restoring confidence.

At a Glance

• About 33.7 million Coupang customer accounts were exposed in a breach described as South Korea's largest in more than a decade.
• Unauthorized access is believed to have begun on June 24 and was detected on November 18.
• Exposed information includes names, email addresses, phone numbers, shipping addresses and portions of order histories.
• Coupang says payment details and passwords were not accessed and that it has blocked the access route.
• Police are examining whether a former developer used credentials or signature keys that remained valid after departure.
• President Lee Jae Myung has called for tougher penalties and faster accountability.
• The current fine ceiling is 3 percent of revenue, potentially reaching one trillion won or more depending on the calculation.
• Police, KISA and the PIPC are investigating, and law firms are preparing class action suits.
• KISA warns that leaked contact and delivery information could be used in phishing and impersonation scams.
• Authorities are reviewing stronger penalties, reporting requirements and checks on internal access controls.