South Korea Confirms 33.67 Million Coupang Records Leaked as U.S. Legal and Diplomatic Pressure Grows

Millions of Records Exposed, With Risks Beyond Account Holders

South Korea's Ministry of Science and ICT confirmed on Tuesday that 33,673,817 Coupang user records were leaked, blaming failures in the company's authentication systems and handling of security credentials. The findings, presented nearly three months after Coupang detected the intrusion on November 17, 2025, have intensified regulatory, legal and diplomatic pressure on the country's dominant e-commerce platform.

The total is equivalent to roughly two-thirds of South Korea's population of 51 million, making the incident one of the largest consumer data breaches in the country's history. Its reach extends across a large portion of the digitally active population, with potential exposure reaching people whose delivery details were saved by someone else.

A former employee accessed names and email addresses through customer information pages. Investigators also counted 148.05 million accesses to delivery address list pages and approximately 100,000 unauthorized views of order list pages. Delivery information potentially exposed included names, phone numbers, physical addresses and anonymized apartment entrance passwords.

Coupang allows each user to save up to 20 delivery addresses. A single account can therefore contain details about several households, including relatives and friends. The amount of location information exposed could be much larger than the basic account count, extending the privacy risks beyond people who personally shop on the platform.

Choi Woo-hyuk, head of the ministry's cybersecurity and network policy office, presented the findings at a government briefing in Seoul. By February 11, 2026, the case had expanded into a dispute over the scale of the breach, the company's response and whether South Korea's enforcement was treating a company listed in the United States unfairly.

How a Former Employee Bypassed Login Controls

Investigators identified the attacker as a former Coupang employee who had developed user authentication software while working at the company. Authentication is the process a service uses to check whether someone is entitled to enter an account. The employee's knowledge of that system became central to the attack.

The former employee stole a signing key from the authentication system, according to the government analysis. A signing key acts like a secret stamp that tells a service an access request is genuine. With that key, the attacker forged what officials described as an electronic access pass and bypassed normal login procedures.

The forged pass continued to work after the employee left Coupang. Preliminary attack tests took place between January 5 and January 20, 2025. The main attack then ran from April 14 to November 8, allowing unauthorized access to continue undetected for nearly seven months.

Web crawling tools helped the attacker extract information systematically. Such tools automate repeated requests to pages, allowing someone to collect information at a scale far beyond manually opening individual accounts.

Lee Dong-geun, head of the Digital Threat Response Division at the Korea Internet & Security Agency, said investigators found that current Coupang developers had stored signing keys on personal laptops. Internal rules required those credentials to remain within management systems. Investigators identified that storage practice as the vulnerability that enabled the breach.

What Investigators Found in Coupang's Systems

The Edit My Information page was used to harvest 33,673,817 records containing names and email addresses. The delivery address list page recorded 148.05 million accesses, while the order list page recorded approximately 100,000 unauthorized views.

The three figures measure different parts of the attack. The first is a count of records harvested from the customer information page. The delivery and order figures count page accesses, meaning repeated requests involving the same account can contribute to those totals. Delivery lists nevertheless contained more kinds of sensitive information than names and email addresses alone.

Investigators also confirmed that the attacker possessed systems capable of transmitting data to cloud servers overseas. They could not verify whether those transfers actually occurred. The confirmed finding was that the attacker had the means to send information outside the country, alongside extensive unauthorized access to Coupang's services.

Coupang's investigation and the government's examination have produced sharply different descriptions of the damage. The company has focused on the amount of information it says the attacker saved. Officials have focused on the personal information the attacker was able to view through company systems.

Why the Government Called It a Management Failure

Choi described the breach as a failure of Coupang's security management, pointing to weaknesses in authentication controls and the handling of signing keys. His assessment placed responsibility on how the company protected access to customer information.

This is a clear management failure by Coupang, not a sophisticated attack. The team identified shortcomings in the management of authentication systems and signing keys.

The ministry's conclusion connects the attacker's access to specific operational failures. Credentials that could authorize entry into customer accounts were stored outside the systems designated to protect them, and the attacker was able to continue using a forged access pass after leaving the company.

The government also identified compliance failures after Coupang discovered the intrusion. Under the mandatory reporting window of 24 hours, the company should have notified authorities by November 18. It reported the breach on November 19 instead.

The ministry plans to impose an administrative fine for that delay, with the penalty potentially reaching 30 million won. An administrative fine is a financial penalty imposed for breaking a regulatory requirement, separate from the other investigations surrounding the breach.

Deleted Logs Bring a Further Investigation

Coupang also allegedly breached a data preservation order issued on November 19. Authorities instructed the company to retain evidence, but it did not adjust its automatic log retention policies. Logs are records of activity within a computer service and can help investigators reconstruct who accessed information and when.

Web access logs covering July through November 2024 were deleted, along with app access logs covering May 23 through June 2, 2025. The app records covered part of the period during which investigators say the attacker was operating.

Officials asked law enforcement to investigate potential obstruction connected with the destruction of evidence. That inquiry adds another line of legal scrutiny to the reporting violation and the security failures identified by the ministry.

Coupang must submit preventive measures to the ministry by the end of February. Implementation is scheduled for March through May, followed by government inspections in June and July. The timetable moves the case from identifying failures toward checking whether the company's changes are actually in place.

Why Coupang and Regulators Disagree About the Scale

Coupang has maintained that, although 33.7 million accounts were technically affected, the actual damage was limited. Based on the attacker's testimony, the company said only approximately 3,000 records were stored on the perpetrator's hard drive and were subsequently deleted.

Regulators and privacy advocates have criticized that position as an attempt to minimize the company's regulatory and reputational damage. Choi said South Korean data protection standards treat unauthorized access to personal information pages as a breach, whether or not the information was saved locally or sent elsewhere.

Choi challenged the company's emphasis on the 3,000 records and explained how investigators reached their assessment:

Calling it an access does not mean less liability. The figure of 3,000 records is merely a company claim and serves only as a reference. We verified all materials independently. We examined Coupang servers to determine how much data was accessed by external attackers and how much was leaked.

A Coupang representative responded that the 148 million accesses to delivery list pages did not indicate the scale of the information breach. The spokesperson described them as attempts to collect individual personal data associated with the 33.7 million accounts, rather than 148 million separate compromises.

Government officials said the volume of requests demonstrated the attacker's capacity to collect comprehensive customer profiles. Coupang's argument centers on confirmed storage by the attacker; the authorities' approach centers on unauthorized viewing, alongside the discovery of systems designed to transmit information overseas.

A Timeline From Attack Tests to Inspections

The case spans more than a year, beginning with attack preparations in January 2025 and extending into planned government inspections in July 2026. The dates show how long the unauthorized access continued and how several inquiries now overlap.

• January 5 to January 20, 2025: The former employee conducted preliminary attack tests.
• April 14 to November 8, 2025: The main period of unauthorized access lasted nearly seven months.
• November 17, 2025: Coupang detected the intrusion.
• November 18, 2025: The mandatory deadline for reporting the breach fell.
• November 19, 2025: Coupang notified authorities, and a data preservation order was issued.
• February 5, 2026: A separate disclosure identified an additional 165,000 compromised user records.
• February 10, 2026: The ministry presented its findings at the Tuesday briefing in Seoul.
• February 23, 2026: Interim CEO Harold Rogers is due to testify under a U.S. House Judiciary Committee subpoena.
• End of February 2026: Coupang must submit preventive measures to the ministry.
• March through May 2026: The company is scheduled to implement those measures.
• June and July 2026: Government inspections are scheduled.

The disclosure of another 165,000 compromised records on February 5 intensified public anger and reinforced perceptions that Coupang's initial assessments understated the damage. Those records were disclosed separately from the main breach.

Police, Congress and a New York Lawsuit

Interim CEO Harold Rogers faces pressure in both South Korea and the United States. South Korean police questioned him for approximately 12 hours over allegations of perjury connected with testimony about the breach.

The U.S. House Judiciary Committee has subpoenaed Rogers to testify on February 23, 2026. Its inquiry examines whether South Korean regulators are imposing unfair burdens on companies listed in the United States.

Coupang, which is listed on Nasdaq and has substantial American investor backing, has attracted attention from U.S. lawmakers who view South Korea's response as potentially discriminatory targeting of an American firm. That has turned a domestic cybersecurity investigation into a bilateral issue.

A class action lawsuit in New York federal court seeks punitive damages against Coupang. The action represents investors and users who claim losses from inadequate data protection and misleading disclosures about the breach's scope. Punitive damages seek to punish alleged misconduct, rather than simply repay a claimed loss.

The lawsuit alleges that security failures were followed by efforts to downplay the incident. It adds financial exposure in the United States to the company's regulatory and criminal scrutiny in South Korea.

Seoul Rejects Claims of Unequal Treatment

Some multinational companies operating in Seoul have privately described the response to Coupang as unprecedented compared with the treatment of domestic firms. They point to an investigation involving nine agencies and hundreds of officials.

Those companies cite a 2025 breach at SK Telecom affecting 27 million records, which they say did not trigger comparable investigations. Coupang's confirmed total of about 33.67 million is approximately 6.67 million higher than that figure, while the dispute over enforcement concerns the breadth of the government response.

The Ministry of Science and ICT has denied departing from legal principles or treating Coupang differently from any company facing similar violations. The investigation team also rejected speculation that the public announcement had been postponed because of U.S. trade pressure and discrimination allegations.

Investigators said they had maintained legal standards throughout the inquiry and disclosed results promptly and transparently as they became available. Their response addressed concerns that diplomatic considerations were influencing the handling of the case.

President Lee Jae-myung has pledged to make South Korea the best investment destination in the world. The Coupang investigation places that ambition alongside demands for strong protection of consumer information, testing how Seoul manages privacy enforcement and relations with foreign investors.

Business Exposure and Risks for Customers

Coupang faces consequences beyond the potential fine for late reporting. The Federal Trade Commission has warned of possible business suspension, a measure that would halt company operations entirely. The commission is also conducting a tax audit and has received a parliamentary complaint against founder Bom Kim and former executives.

Industry analysts view the case as setting new compliance benchmarks for South Korean consumer platforms. The government's detailed reconstruction of access counts and attack dates signals an intention to establish specific control requirements for other businesses holding large amounts of personal information.

Customers face a different set of concerns. Phone numbers, delivery addresses and building entrance passwords can create opportunities for targeted fraud, stalking and threats to physical security. Information about relatives and friends saved in an account can expose people who had no direct relationship with Coupang.

Payment cards can be cancelled, and financial institutions can monitor transactions after a card breach. Home addresses and contact details remain sensitive over time. That makes the delivery information a lasting concern alongside the names and email addresses confirmed in the main record count.

The next scheduled steps are Rogers' congressional appearance on February 23 and Coupang's submission of preventive measures by the end of February. Government inspections in June and July are intended to check implementation after the work scheduled for March through May.

The Essentials

• The ministry confirmed that 33,673,817 Coupang user records containing names and email addresses were leaked.
• A former employee used a stolen signing key to bypass login controls between April 14 and November 8, 2025.
• Investigators counted 148.05 million delivery list accesses and approximately 100,000 unauthorized order list views.
• Coupang says approximately 3,000 records were saved and later deleted; regulators count unauthorized viewing as a breach.
• The ministry cited late reporting and alleged evidence destruction, with a potential reporting fine of 30 million won.
• A separate February 5 disclosure identified an additional 165,000 compromised records.
• Harold Rogers faces a February 23 U.S. congressional appearance after approximately 12 hours of police questioning in South Korea.
• A New York class action seeks punitive damages, while South Korean authorities face U.S. allegations of unequal treatment.
• The Federal Trade Commission has warned of possible business suspension and is conducting a tax audit.
• Preventive measures are due by the end of February, with implementation in March through May and inspections in June and July.