Korea’s Coupang says data breach exposed nearly 34M customers’ personal information

Coupang, a prominent South Korean e-commerce platform, disclosed over the weekend that a significant data breach had compromised the personal information of nearly 34 million customers. This breach, which persisted for more than five months, was initially detected when the company identified the unauthorized exposure of 4,500 user accounts on November 18. However, further investigation revealed that the breach impacted approximately 33.7 million accounts across South Korea. The exposed data includes customer names, email addresses, phone numbers, shipping addresses, and certain order histories. Fortunately, Coupang has confirmed that more sensitive information, such as payment details, credit card numbers, and login credentials, remain secure. In response to the incident, Coupang has informed the Korea Internet Security Agency (KISA), the Personal Information Protection Commission (PIPC), and the National Police Agency about the breach. As one of South Korea's largest e-commerce platforms, Coupang also operates in Japan and Taiwan, providing a quick-commerce service known as "Rocket Delivery." A spokesperson for Coupang stated that the investigation has not uncovered any evidence indicating that data from its Taiwan operations or the Rocket Now service was compromised. According to the company, unauthorized access to personal information is believed to have started on June 24, 2025, through overseas servers. Coupang has since blocked this unauthorized access and reinforced its internal monitoring systems, also enlisting experts from a top independent security firm to assist. Following the complaint filed on November 18, police investigations have reportedly led to the identification of at least one suspect—a former employee of Coupang who is currently outside the country. This incident marks another in a series of cybersecurity challenges faced by South Korea this year, with Coupang previously experiencing several breaches that exposed the data of customers and delivery drivers in prior years, including significant leaks between 2020 and 2021 and a recent incident in December 2023 affecting over 22,000 customers.