Coupang's $1.17 Billion Breach Compensation Draws Backlash Over Restricted Vouchers

Millions of Customers, Four Restricted Coupons

Coupang is offering 33.7 million affected users purchase vouchers worth 50,000 won each after a massive data breach, putting the announced compensation package at 1.69 trillion won, approximately $1.17 billion. Yet only 5,000 won of each customer's allocation can be spent on the South Korean company's main shopping platform.

The remaining vouchers are divided between food delivery, travel and luxury shopping. That structure has drawn criticism from lawmakers, consumer advocates and customers, who argue that a package presented as compensation could instead steer people toward more spending within Coupang's businesses.

As of December 30, 2025, the company faces overlapping pressures: a government investigation, parliamentary hearings, the departure of its chief executive and anger over founder and chairman Kim Bom-suk's refusal to attend the hearings. His written apology on Sunday, nearly a month after the breach was revealed, has also brought renewed attention to the company's communication during the crisis.

The breach exposed personal information associated with a user count equivalent to nearly two-thirds of South Korea's population. Names, telephone numbers, delivery addresses and email addresses were among the information compromised. Some accounts also had parts of their order histories exposed.

Coupang says banking details, payment card information and login credentials were not obtained. Customers nevertheless face risks from the exposure of information that could help someone impersonate a familiar business or make a fraudulent message appear convincing.

The compensation plan is unprecedented in its financial scale, but the immediate dispute concerns its practical value. A customer who uses Coupang mainly for everyday shopping receives a much smaller benefit on that service than the headline figure of 50,000 won suggests.

How the Breach Unfolded

Coupang discovered the breach on November 18. Investigations suggest that unauthorized access began on June 24, 2025, leaving a period of months during which the intrusion went undetected.

The suspect has been identified as a former employee of Coupang's IT department, a 43-year-old Chinese national who worked at the company between November 2022 and 2024. The investigation points to a serious security failure involving someone who had previously worked inside the business.

The information exposed matters because it describes how customers can be contacted and where they receive deliveries. Certain order histories could also give a fraudster details that make a message sound more personal. Phishing is an attempt to trick someone into handing over information or money by posing as a trusted person or organisation. Identity fraud involves using another person's details to impersonate them.

The main dates and developments are:

• November 2022 to 2024: The former IT employee identified as the suspect worked at Coupang.
• June 24, 2025: Unauthorized access began, according to cybersecurity reports described in the investigation.
• November 18: Coupang discovered the breach.
• December 2025: CEO Park Dae-jun resigned, and Harold Rogers became interim CEO.
• Sunday before December 30: Founder and chairman Kim Bom-suk issued a written apology.
• By December 30: The voucher compensation package had been announced, with parliamentary hearings commencing and government investigations continuing.

What Coupang Says Was Recovered

Coupang's account of the investigation distinguishes between the large number of affected users and the smaller amount of customer information it says was stored on the suspect's computer. Kim Bom-suk, the company's founder and chairman, described the findings in a statement:

It was confirmed that the customer information stored on the leaker's computer was limited to 3,000 cases, which were also not circulated or sold externally,

Cybersecurity firms including Mandiant and Palo Alto Networks have assisted with the investigation. Stolen data was recovered, and authorities seized storage devices belonging to the suspect, including hard drives and a MacBook Air laptop reportedly disposed of in a river.

Coupang asserts that the data was not disseminated. The figure of 3,000 concerns information stored on the computer, while the compensation plan covers 33.7 million affected users. The scale of potential access has left millions of customers feeling vulnerable even as the company points to the recovery of data.

What Each Customer Would Receive

Coupang's plan covers both paying subscribers to its "Wow" membership programme and general users. Former customers who deleted their accounts after receiving the breach notification are also eligible.

Each affected user would receive four separate vouchers, rather than cash or one voucher usable across the company:

• 5,000 won for Coupang's main shopping platform.
• 5,000 won for Coupang Eats, its food delivery service.
• 20,000 won for Coupang Travel.
• 20,000 won for R.LUX, its luxury beauty and shopping platform.

The total of 50,000 won is approximately $35 per person. Travel and luxury shopping account for 40,000 won, or 80% of the allocation. Main platform shopping and food delivery together account for the remaining 10,000 won, or 20%.

Harold Rogers, the interim CEO of Coupang Corp., said in a press release that the package was intended to address the breach and rebuild customer confidence:

We decided to establish a compensation plan worth 1.68 trillion won to take responsibility for the recent leak of personal information and to restore customer trust,

Rogers also described the decision as a "responsible measure for our customers" and pledged that the company would "fulfill its responsibilities to the end." The announced package is described as worth 1.69 trillion won, while his quoted statement gives the closely rounded figure of 1.68 trillion won.

A voucher gives its holder credit toward an eligible purchase. Its usefulness depends on whether the customer wants something from the service where it can be spent. Splitting the allocation across four businesses therefore makes a customer's normal shopping habits central to the value they can obtain.

Why Critics Call the Plan Marketing Bait

Customers who primarily use Coupang for everyday shopping can apply only 5,000 won, roughly $3.70, to that platform. The larger travel and luxury vouchers are tied to services with higher price points and a narrower customer base.

Consumer advocates argue that using the full compensation may require people to spend more of their own money. A discount on a purchase that costs more than the voucher still leaves the customer with a bill. For someone with no intention of booking travel or buying luxury goods, those vouchers may have little practical value.

The People's Solidarity for Participatory Democracy, a prominent civic group, called the package a "trick to boost Coupang's revenue." It argued that the restrictions served the company's expansion into other markets:

Providing 20,000 won vouchers that can only be used for Coupang's least popular services such as Coupang Travel and R.LUX is another scheme to expand its market share in travel booking and luxury shopping,

Lawmakers preparing for parliamentary hearings have voiced similar objections. They say services such as Coupang Travel are unfamiliar or irrelevant to many users, leaving the largest part of the compensation of little use to them.

Representative Choi Min-hee of the ruling Democratic Party, who chairs the National Assembly's Science, ICT, Broadcasting, and Communications Committee, criticized Coupang for attempting to turn a crisis into an opportunity. The dispute has shifted attention from the package's headline size to the conditions attached to receiving a useful benefit.

Coupang presents the vouchers as a way to take responsibility and restore trust. Critics see a revenue opportunity built into the response. The disagreement centres on whether compensation should leave customers free to decide how to use it, rather than directing them toward particular company services.

A Leadership Change and a Delayed Apology

Park Dae-jun resigned as CEO earlier in December amid the fallout from the breach. Harold Rogers took over as interim CEO, giving the company new operational leadership while investigations and public criticism continued.

Kim Bom-suk's response has attracted especially sharp scrutiny. In his written apology on Sunday, the founder and chairman acknowledged that Coupang had failed to communicate clearly from the outset. He said he had delayed a public apology until the facts were confirmed and described that decision as "poor judgment."

Kim explained his regret in the statement:

In retrospect, this was a poor judgment. While Coupang worked tirelessly to resolve the situation, I should have expressed my deepest regrets and sincere apologies from the beginning. My heart has been heavy ever since I first learned of the data breach,

The apology came nearly a month after the breach was revealed. For customers seeking answers about their personal information, the delay became part of the wider concern about how the company handled the incident.

Kim has declined to attend National Assembly hearings, citing his residence and business abroad. Lawmakers seeking direct answers from senior leadership have expressed frustration with his absence. Their scrutiny extends to both the security failures and the decisions made after the company discovered them.

Government Agencies Examine the Response

A task force spanning government agencies is investigating the Coupang case. It is chaired by Bae Kyung-hoon, deputy prime minister and minister of science and ICT, and coordinates work involving the National Police Agency, the Personal Information Protection Commission and the Financial Services Commission.

The task force has warned that Coupang could face severe consequences. The government has described the leak of information belonging to more than 30 million users as a clear violation of Korean law.

The Fair Trade Commission is examining whether Coupang's response, including its voucher plan, sufficiently addresses consumer harm. That assessment will play a key role in determining whether the company faces a business suspension. A suspension would affect its ability to continue operating, making this a commercial threat as well as a regulatory one.

South Korea's media and telecoms regulator has also opened an investigation into whether Coupang unlawfully restricted customers' ability to delete their accounts after the breach was disclosed. The issue concerns whether people trying to leave the platform encountered an unnecessarily difficult process during a period of alarm.

A finding that Coupang obstructed account deletion could bring additional penalties under telecoms laws and consumer rights rules. The inquiries therefore cover several parts of the crisis: the loss of personal information, the adequacy of compensation and the treatment of customers who wanted to end their relationship with the company.

No final regulatory penalties, business suspension decision or detailed hearing dates were given as of December 30. Parliamentary hearings were commencing, while the agencies continued examining the breach and the company's response.

Why Investors Reacted More Calmly

Coupang shares rose 0.7% in midday trading following the compensation announcement. The modest gain contrasted with the strong criticism from customers, civic groups and lawmakers.

The market response suggests investors may regard the voucher package as a manageable business cost compared with possible cash compensation or regulatory fines. Because the offer consists of credit for company services, its announced value and its effect on the business depend on how customers use the vouchers.

Coupang posted net income of $95 million in its most recently reported quarter. The compensation package's stated value of $1.17 billion is more than 12 times that quarterly profit, showing why the financial consequences are receiving close attention even after a relatively restrained stock market reaction.

The company has already warned that litigation and efforts to remedy the breach could bring higher expenses. Investors are watching how the compensation costs and possible regulatory penalties affect earnings in the coming quarters.

The share price response may reflect an expectation that the voucher plan will help resolve the incident and that much of the bad news is already reflected in the stock's value. Parliamentary scrutiny and the possibility of a business suspension remain additional sources of uncertainty for the company.

Compensation Has Become Part of the Trust Dispute

Coupang's attempt to repair its relationship with customers has created a fresh controversy over what meaningful restitution should look like. The company points to a package exceeding $1 billion. Customers and advocates focus on how little of each allocation can be used for ordinary shopping.

The contrast is concrete: each user is promised 50,000 won, but 40,000 won is reserved for travel and luxury services. The same package can therefore feel useful to a customer already planning those purchases and largely irrelevant to someone who uses Coupang only for everyday goods.

The breach has also made corporate accountability central to the debate. Customers are seeking protection for their personal information, lawmakers want answers from senior leadership, and regulators are examining whether the response sufficiently addresses harm.

Coupang's next steps will be judged against all three concerns. The voucher restrictions, the founder's absence from hearings and the continuing investigations have made rebuilding trust more complicated than announcing a large compensation figure.

The Bottom Line

• The breach affected 33.7 million users and exposed names, telephone numbers, delivery addresses, emails and some order histories.
• Unauthorized access reportedly began on June 24, 2025; Coupang discovered the breach on November 18.
• Coupang says financial information and login credentials were not obtained, and says 3,000 cases of customer information stored on the suspect's computer were recovered without external circulation or sale.
• The announced compensation package totals 1.69 trillion won, approximately $1.17 billion, through vouchers worth 50,000 won per affected user.
• Travel and luxury vouchers make up 80% of each allocation; only 5,000 won can be used on the main shopping platform.
• CEO Park Dae-jun resigned in December. Founder Kim Bom-suk apologized but declined to attend parliamentary hearings.
• Government agencies are investigating the breach, compensation and account deletion practices, with possible penalties including a business suspension.