Coupang says breach exposed data from 33.7 million customer accounts
Coupang, South Korea's largest e-commerce company, said about 33.7 million customer accounts in South Korea were affected by a data breach, after first reporting that 4,500 accounts had been exposed, TechCrunch reported on Dec. 1.
The number is equal to well over half of South Korea's population, and the breach went undetected for more than five months.
What happened
Coupang said it detected unauthorized exposure of 4,500 accounts on Nov. 18, 2025. A wider investigation found that unauthorized access had begun on June 24, 2025, via overseas servers. The exposed data includes names, email addresses, phone numbers, shipping addresses and some order histories. The company said payment information, card numbers and login credentials were not compromised, and that it found no evidence that its Taiwan business or its Japanese food delivery service were affected.
Coupang said it blocked the access route, increased internal monitoring and hired an outside security firm. It reported the breach to the Korea Internet and Security Agency, the Personal Information Protection Commission and the National Police Agency. Police reportedly identified at least one suspect, a former Coupang employee living abroad.
Fallout
Update: Chief executive Park Dae-jun resigned on Dec. 10 and police raided the company's Seoul headquarters. On Dec. 28, founder and board chair Kim Bom-suk apologized for what he called an inadequate initial response and lack of communication, but declined to attend parliamentary hearings, the Korea Times reported. Coupang said it had recovered the leaked data, that data on the suspect's computer was limited to about 3,000 cases, and that it had not been sold. South Korea's science ministry said those claims had not been verified by the joint public-private investigation.
Context
The breach was one of several security incidents at major South Korean companies and government bodies in 2025. Coupang had an earlier breach in December 2023 that exposed information on more than 22,000 customers through its seller management system, TechCrunch noted.
What to do
Coupang customers, including those living abroad, should be alert to texts and calls that cite real orders or delivery addresses. Do not click delivery links in unsolicited messages; check order status in the official app.
