Coupang Breach Adds 165,000 Victims as US Pressure Deepens South Korea Trade Dispute

Nearly 33.9 million customers caught in widening crisis

Coupang confirmed on February 5, 2026, that another 165,000 customers had personal information exposed in a data breach already affecting 33.7 million users. The additional cases brought the total to roughly 33.9 million, about two-thirds of South Korea's population, as the investigation became entangled with American trade pressure and a threatened increase in tariffs.

The Seattle-based company, often called the Amazon of South Korea, said the newly identified exposure involved names, telephone numbers and addresses, but excluded payment information and login credentials. Coupang said it had notified affected customers following government guidance.

By February 6, the dispute stretched from customer databases to the White House, South Korea's National Assembly and a possible international arbitration case. Korean authorities described the incident as the country's largest corporate data leak. Potential penalties, investor claims and competing accounts of how much information was actually retained have widened the conflict.

Wi Sung-lac, South Korea's presidential national security adviser, said in an interview published on February 5 that the Coupang issue was undermining several parts of the relationship with Washington, including trade and security cooperation. His warning put a corporate security failure inside a dispute affecting an alliance that has lasted seven decades.

President Donald Trump's administration had recently announced an increase in tariffs on South Korean automobiles and other imports from 15 percent to 25 percent. Wi linked that move to the Coupang dispute and other regulatory tensions involving American technology companies. Other officials rejected that connection, leaving Seoul to defend its investigation while managing pressure over trade.

What happened to the customer information?

Coupang disclosed in November 2025 that personal information belonging to 33.7 million customers had been compromised. The company later said the breach had escaped detection for five months, adding to public anger about both the exposure and the delay in discovering it.

Investigators identified a former Coupang employee based in China as the alleged perpetrator. The individual allegedly accessed customer databases containing names, telephone numbers, home addresses and email addresses without authorization.

Coupang has maintained that the person transmitted or retained only about 3,000 records and passed no information to third parties. South Korean authorities have used 33.7 million as the scope of the original exposure. Those figures describe different stages of the incident: the larger number concerns information exposed to unauthorized access, while the company's smaller figure concerns records it says were actually transmitted or kept.

The February 5 disclosure added 165,000 customers to the affected population. The investigation had not resolved the disagreement over the full damage as of February 6. For customers, the immediate concern remained that identifying and contact information had been exposed, even though Coupang said payment details and login credentials were excluded.

How the dispute developed

The crisis unfolded over several months, moving from a breach disclosure to parliamentary scrutiny, American political intervention and investor action under a trade agreement.

• November 2025: Coupang disclosed the exposure of information belonging to 33.7 million customers.
• January 13, 2026: Representative Adrian Smith accused South Korea of targeting American companies and cited regulatory action against Coupang.
• January 23: Vice President J.D. Vance raised the treatment of American technology companies with South Korean Prime Minister Kim Min-seok at the White House.
• January 28: Foreign Minister Cho Hyun rejected a connection between the Coupang investigation and Trump's tariff announcement during a seminar in Seoul.
• February 5: Coupang disclosed another 165,000 affected customers, while Wi's published interview warned of damage to trade and security ties.

The next steps depended on several proceedings running at once: the breach investigation, competition inquiries, parliamentary scrutiny and the investors' proposed arbitration. No date for a final breach finding, penalty decision or arbitration hearing was given.

Parliamentary anger and a disputed compensation package

South Korea's National Assembly opened an inquiry involving multiple committees into Coupang's data protection failures, corporate governance and labor practices. Lawmakers also challenged how the company's leadership responded to their summons.

Founder and chairman Kim Beom-seok, a U.S. citizen, declined to attend the parliamentary hearing despite being summoned. Interim chief executive Harold Rogers appeared instead. Lawmakers accused the company of disrespecting democratic institutions.

Coupang's record compensation package of 1.69 trillion won, described as $1.17 billion, failed to settle the controversy. Critics dismissed it as a superficial response. Consumer advocates also criticized what was described as a $1 billion voucher offering, saying it was a temporary public relations measure rather than a genuine remedy for the security failures.

The public reaction reflected anger at a company viewed by many Koreans as a foreign business making substantial profits from local customers while failing to protect their information. Compensation therefore became part of a larger argument about responsibility, rather than simply a question of the package's advertised value.

Washington turns up the pressure

Coupang has spent $10.75 million on lobbying over the past five years, targeting Congress and the executive branch. As scrutiny intensified in Seoul, the company sought to frame its treatment as discrimination against an American enterprise.

Vice President Vance personally warned Prime Minister Kim during their January 23 White House meeting against penalizing American technology companies. He expressed hope that the dispute could be resolved fairly and without creating tension between the two countries.

Representative Adrian Smith, chairman of the House Ways and Means Committee's Trade Subcommittee, made a similar argument on January 13, identifying Coupang as an example of what he considered discriminatory regulation.

Unfortunately, it's my observation that Korea continues to pursue legislative efforts explicitly targeting U.S companies... One example would be Coupang through discriminatory regulatory actions.

Representative Scott Fitzgerald described the Korean government's actions as a politically motivated witch hunt. After Trump's tariff announcement, House Judiciary Committee Republicans directly connected trade retaliation with the investigation.

this is what happens when you unfairly target American companies like Coupang

James Heller, the chargé d'affaires at the U.S. Embassy in Seoul, also wrote to South Korean authorities. He urged them to follow a joint fact sheet affirming that American companies should face neither discrimination nor unnecessary barriers in digital services. Together, those interventions elevated the dispute well beyond discussions between regulators and a company.

Why the tariff connection is contested

Trump's announced tariff increase would move the rate on South Korean automobiles and other affected imports from 15 percent to 25 percent, a rise of 10 percentage points. For President Lee Jae Myung's administration, that created pressure on trade while domestic demands for corporate accountability remained intense.

Wi explicitly linked the tariff move to Coupang and other regulatory tensions involving American technology firms. The accumulation of American political pressure also persuaded many observers in Seoul that the increase represented retaliation for the investigation.

Foreign Minister Cho took a different position at the January 28 seminar. He said interpreting the tariff action as connected to the breach investigation was inaccurate and would unnecessarily weaken South Korea's negotiating position. Both governments officially denied the connection.

Seoul consequently faced two connected political arguments: whether Coupang was receiving fair treatment under Korean law, and whether American trade pressure was influencing that treatment. Wi's warning extended beyond tariffs to security cooperation, explaining why a commercial dispute had become a concern for the wider alliance.

Investors seek protection under the trade agreement

Greenoaks Capital and Altimeter Capital, two major American investors in Coupang, filed a Notice of Intent to Arbitrate against South Korea under the U.S.-Korea Free Trade Agreement, known as KORUS. Greenoaks alone held more than $1.4 billion in Coupang shares.

A notice of intent is a step toward asking an international arbitration panel to hear an investment dispute. The investors alleged that Seoul had breached fair treatment standards and discriminated against an American company to benefit Korean competitors, including Naver, and Chinese firms.

The filing accused Korean authorities of repeated raids, blocking contracts and publicly threatening punitive action. It portrayed the investigation as a pretext to eliminate a successful American company's ability to compete, and compared Seoul's conduct with that of Venezuela or Russia.

The investors claimed current losses in the hundreds of millions of dollars and potential future losses in the tens of billions. Their allegations also carried an explicit political argument: they accused President Lee and the ruling Democratic Party of taking an anti-American, pro-China position, cited Lee's past controversial remarks about U.S. Forces Korea, and pointed to cabinet appointments of former Naver executives as creating conditions for action against Coupang's market position.

Coupang distanced itself from the filing, saying the arbitration initiative was unrelated to the company itself and that it was fully cooperating with all government investigations. The company nevertheless acknowledged that Chairman Kim had apologized in the face of what it called a relentless government campaign.

Seoul says the same rules apply to every company

Prime Minister Kim rejected the discrimination allegations during his Washington visit. He told American lawmakers there was absolutely no discrimination against Coupang and said the relationship between the two countries rested on trust, so there was no need to worry about discriminatory treatment.

Trade Minister Yeo Han-koo delivered the same message in meetings with U.S. Trade Representative Jamieson Greer at the World Economic Forum in Davos. Yeo said the investigation followed the approach authorities would take toward a Korean company responsible for a data leak.

The government is currently conducting an investigation in a non-discriminatory and transparent manner in the same way we would have done against any Korean company that had a data leak, not because it is an American company.

Yeo pointed to the seriousness of a breach affecting millions of people, delayed reporting and unverified claims directed at national leaders. Those circumstances, he said, would draw scrutiny regardless of a company's nationality.

President Lee maintained a firm domestic position, calling for tough penalties for negligence involving data breaches. He said the case should serve as a wake-up call for corporate accountability. His stance signaled no immediate retreat from the investigation despite American pressure.

Competition inquiries widen the regulatory exposure

South Korea's Fair Trade Commission expanded its scrutiny beyond data protection, deploying more than 30 investigators across three divisions in an inquiry entering its third week. Officials were examining allegations about Coupang's treatment of partner merchants and the way products appeared on its platform.

The commission was investigating whether Coupang pressured merchants to convert their best-selling products into the company's own brands. It was also examining allegations that Coupang manipulated algorithms, the computer rules that determine what shoppers see, to give its own products priority over competing goods.

Regulators were reviewing whether Chairman Kim should be designated the company's Same Person under Korean competition rules. That designation identifies the controlling individual and brings additional regulatory obligations.

Coupang's WOW Membership program, which bundles delivery and streaming services, was also under review for possible abuse of market dominance. Penalties for that conduct could reach 6 percent of related revenue.

A separate task force brought together seven government agencies, including the National Intelligence Service, Financial Services Commission and National Police Agency. Under the Personal Information Protection Act, Coupang faced a potential data protection fine reaching 1 trillion won, given as $770 million. Such a penalty would be the largest of its kind in Korean history. The prospect helped drive American investors toward arbitration.

Kevin Warsh's board role adds another Washington connection

Kevin Warsh, Trump's nominee to lead the Federal Reserve, had served on Coupang's board since October 2019. He had received more than $1 million in compensation, including nearly $325,000 annually since 2022.

The Federal Reserve Act requires members of the Board of Governors to devote their entire time to the board's business, effectively barring outside employment. New members have six months to bring themselves into compliance.

Federal Reserve rules also prohibit members from holding positions at banks or banking institutions. An e-commerce platform occupies a different regulatory category from a traditional bank, making the full-time service requirement a central issue for Warsh's outside role.

The White House had not commented on whether Warsh would need to divest his Coupang holdings before confirmation. Warsh had not responded to inquiries about his intentions for the board position.

His nomination placed a company director in line to lead American monetary policy while Coupang sought Washington's help against regulatory pressure in Seoul. His compensation and corporate ties therefore added a potential conflict of interest issue to an already sensitive international dispute.

Consumers and civic groups demand accountability

Civic groups pushed back against what they regarded as American interference in South Korea's legal processes. The Korean American Public Action Committee urged Coupang not to conceal the truth through political lobbying and a U.S. congressional hearing, and warned against creating conflict between the allies to pursue its own interests.

The committee demanded substantive, responsible compensation for affected customers and transparent disclosure of the leak's full scope. Its demands reflected frustration that a voucher package could leave the underlying questions about security and accountability unanswered.

South Korea's position also concerned its authority to enforce domestic rules governing customer data. A company can be listed in the United States while serving millions of customers in Korea, bringing investment protections and local consumer protection duties into the same dispute.

American investors argued that their investment was being treated unfairly. Korean officials argued that a serious breach required the same investigation any domestic company would face. Those competing positions explain why the case spread from a security failure into arguments about market access, foreign investment and regulatory authority.

A test for Lee's government and the alliance

President Lee faced his first major bilateral crisis since taking office, with pressure to protect consumers at home and preserve cooperation with Washington. Coupang's American listing and investor base had turned Korean enforcement decisions into an issue for American politicians and trade officials.

The case also exposed a broader conflict over digital sovereignty, meaning a country's authority to govern data and digital services within its jurisdiction. Seoul insisted that its investigation belonged under domestic law rather than trade negotiations, while American pressure sought protection for a company listed in the United States.

American and Chinese platform giants form part of the competitive setting, but the immediate decisions concerned identifiable customers, specific enforcement powers and the company's response. South Korea's handling of the case could establish a precedent for balancing foreign investment protections with consumer rights and national authority over data.

As of February 6, the additional 165,000 affected customers had made the breach larger, while the disagreement over enforcement had made its consequences broader. The investigations, investor action and diplomatic exchanges were proceeding together, with customer compensation and corporate accountability still at the center of the dispute.

Key Points

• Coupang disclosed another 165,000 affected customers on February 5, bringing exposure to roughly 33.9 million people.
• The breach went undetected for five months. Investigators identified a former employee based in China as the alleged perpetrator.
• Coupang said about 3,000 records were transmitted or retained and none were passed to third parties; authorities cited 33.7 million in the original exposure.
• American officials challenged Coupang's treatment, while Seoul said the investigation applied the same standards used for Korean companies.
• Wi Sung-lac linked tariff pressure to the dispute; Foreign Minister Cho Hyun and official positions from both governments rejected that connection.
• Greenoaks Capital and Altimeter Capital initiated a possible arbitration case under KORUS, alleging discrimination and substantial losses.
• Coupang faced a potential data protection fine of 1 trillion won alongside separate competition inquiries.
• Federal Reserve nominee Kevin Warsh's Coupang directorship and compensation added a potential conflict of interest issue.