South Korea Fines Coupang Record $409 Million After Major Data Breach
Summary
South Korea’s privacy regulator fined Coupang a record $409 million after finding a breach exposed data belonging to 33.2 million members and at least 4.3 million non-members. The probe also found separate privacy violations.
Key points
- South Korea’s Personal Information Protection Commission (PIPC) imposed a record 624.7 billion won ($409 million) fine on Coupang over the breach.
- The PIPC found that 33,222,472 registered members and at least 4,338,368 non-members were affected; the non-members’ names, phone numbers, and addresses had been stored as delivery-recipient data.
- The PIPC said a former employee allegedly stole an authentication-system signing key before leaving Coupang, then used it to access delivery-address and account pages and collect customer information.
- Coupang did not detect unusually high page traffic and access attempts, according to the investigation. After regulators ordered log preservation, the company deleted about six months of web access logs; roughly 13% of logs for the attack period were lost.
- The former employee sent two extortion emails. A later email claimed possession of large volumes of address, order, and email records; the article does not establish those claimed totals as independently verified.
- Separate findings included covert collection of browsing activity from about 11.2 million users through Coupang Partners, partner-run redirect ads, and privacy violations involving Coupang Fulfillment Services.
- The PIPC referred Coupang for criminal prosecution over evidence destruction. Coupang said it regretted the decision and may challenge it; mediation proceedings for claimants are set to resume.
Article Details
- Victim Organization
- Coupang
- Incident Type
- Insider data breach involving a former employee who allegedly stole an authentication signing key and used it to access and harvest customer data.
- Data Types Exposed
- Names
- Phone numbers
- Addresses
- Email addresses
- Apartment entry codes
- Order histories, including sensitive purchase histories
- Affected Records
- The PIPC confirmed 33,222,472 affected registered members and identified at least 4,338,368 affected non-members.
- Operational Impact
- Approximately 13% of access logs covering the attack period were lost after Coupang deleted about six months of web access logs and did not suspend routine log deletion. The PIPC said the missing logs made it impossible to identify all affected victims. Coupang was referred for criminal prosecution over destruction of evidence.
- Ransom Or Extortion
- The former employee sent two extortion emails, one to members and one to Coupang. The second email claimed to hold 120 million addresses, 560 million order records, and more than 33 million email addresses; these quantities were claims in the email, not confirmed totals of stolen data.
- Claim Status
- confirmed
People
Vendors
Ernst & Youngan apparent attempt to destroy evidence — which forensic teams from Mandiant, Palo Alto Networks and Ernst & Young were able to document before it was handed to authorities.Mandianthad weighted with bricks in an apparent attempt to destroy evidence — which forensic teams from Mandiant, Palo Alto Networks and Ernst & Young were able to document before it was handed to authorities.Palo Alto Networkswith bricks in an apparent attempt to destroy evidence — which forensic teams from Mandiant, Palo Alto Networks and Ernst & Young were able to document before it was handed to authorities.