Coupang Rocked by Massive Data Breach, 33.7 Million Customers Affected
South Korea's e-commerce giant, Coupang, has issued a public apology following a staggering data breach that compromised the personal information of an estimated 33.7 million customers. This incident, which reportedly began five months ago, has sent shockwaves through the nation, not only due to its immense scale but also because a former employee, a Chinese national, is suspected to be the culprit. This raises serious questions about the company's internal security protocols.
The apology, delivered by Coupang Corp. CEO Park Dae-jun, acknowledged the "inconvenience and concern" caused to potentially all Coupang members. Initially, on November 18, the company estimated only 4,500 affected customers, a figure that has now skyrocketed, making it one of the largest privacy breaches in decades for the country.
Breach Details and Scope
Investigations reveal that the unauthorized access to customer data via Coupang's overseas servers is believed to have started on June 24 and continued until recently. The compromised data includes customers' names, email addresses, delivery addresses, and in some instances, purchase histories. Crucially, Coupang reassures users that sensitive payment details, credit card numbers, and login information remain secure. Despite concerns over the prolonged breach period, the company advises customers that "no cautionary action with their Coupang accounts" is needed, though it recommends vigilance against phishing attempts via calls or texts falsely claiming to be from Coupang.
Alleged Inside Job and Ongoing Investigation
Unlike typical cyberattacks by external criminals, the current suspicion centers on a former Chinese employee who has since resigned and left Korea. This development complicates the ongoing investigation, potentially leading to a deadlock if the individual cannot be apprehended or questioned. Coupang has declined to confirm the identity of the former employee but has reported the incident to key authorities, including the National Police Agency, Korea Internet & Security Agency, and the Personal Information Protection Commission (PIPC). A joint investigative team comprising government, police, and company representatives has been formed to thoroughly examine the breach and whether Coupang failed in its security duties. High-level government officials, including Deputy Prime Minister Bae Kyung-hoon, attended an emergency meeting to address the crisis.
A History of Major Breaches and Mounting Pressure
The sheer volume of affected customers places Coupang's breach among the most significant in South Korean history, surpassing recent incidents like SK Telecom's data leak affecting 23.24 million customers. Other notable past breaches include Gmarket (18 million in 2008), GS Caltex (11 million in 2008), and NATE Communications (35 million in 2011). Given this context, experts anticipate that the government's penalty for Coupang could exceed the record 135 billion won ($92 million) fine imposed on SK Telecom in August for its negligence.
This data breach adds to a challenging period for Coupang, which is already under public scrutiny for its workplace conditions, with over 20 worker deaths since 2020. Furthermore, a special prosecutors’ investigation is underway regarding alleged internal regulation changes by its subsidiary, Coupang Fulfillment Services, to avoid paying severance to day laborers. These combined pressures highlight a critical juncture for the e-commerce giant as it navigates both security failures and broader corporate responsibility concerns.