The South Korean government has tentatively announced that the scale of personal information leaked from Coupang exceeds 33 million cases. The leaked personal data has been accessed over 148 million times. This figure significantly surpasses Coupang’s initial claim that only about 3,000 pieces of personal information were compromised.
On February 10, the Ministry of Science and ICT disclosed the findings of the joint public-private investigation team into the Coupang breach at the Government Seoul Building. The report reveals that 33,673,081 pieces of personal information, including names and email addresses, were leaked from Coupang’s “My Information Modification Page.”
The investigation team also reported that personal information, including names, phone numbers, delivery addresses, and anonymized shared entrance codes, was accessed 148,056,502 times from the “Delivery Address List Page.”
The delivery address list contains information not only about account holders but also about third parties such as family and friends, potentially increasing the number of affected individuals. The 165,000 cases of personal information leakage reported by Coupang on February 5 were not included in this investigation.
The “Delivery Address List Modification Page,” which contains entrance codes that pose a significant risk for potential secondary crimes, was accessed 50,474 times. The “Order List Page,” displaying users’ recent orders, was accessed 102,682 times.
Previously, Coupang claimed on December 25 that the leaker had stored limited customer information from 3,000 accounts only on a personal desktop PC and a MacBook Air, asserting that only about 3,000 accounts were affected. When questioned about the validity of this claim, a Ministry official stated, “That’s just one factor to consider,” adding, “We thoroughly examined Coupang’s servers to confirm the extent of the access and leakage.”
Explaining the cause of the leak, the investigation team revealed that this incident resulted from the actions of a former employee who exploited vulnerabilities in Coupang’s authentication system. The leaker stole the signing key used to manage the user authentication system during their employment and used it to forge electronic access badges, allowing them to access Coupang’s services without proper login.
Coupang’s gateway server failed to detect the forged electronic access badges. The investigation also uncovered that the procedures to revoke the leaker’s signing key upon their departure were inadequate.
Regarding post-incident responses, the investigation confirmed that Coupang violated regulations. Coupang’s chief information security officer received a report about the data leak on November 17, 2022, at 4 PM, but the company only reported it to government authorities at 9:35 PM on November 19, exceeding the legally mandated 24-hour timeframe.
Furthermore, on the day the leak was reported, the Ministry ordered Coupang to preserve materials for cause analysis. However, Coupang failed to adjust its automatic log-saving policy, resulting in the deletion of web access records from July to November 2024. Access records for Apple applications from May 23 to June 2, 2025, were also deleted.
Looking ahead, the Ministry stated, “Based on the investigation results, we will require Coupang to submit an implementation plan for preventive measures and will monitor compliance.” They also indicated plans to impose a fine of up to 3 million KRW (approximately 2,250 USD) for delayed reporting and to request an investigation into violations of the material preservation order.
The final confirmation of the scale of the personal information leak at Coupang, based on this investigation, will be determined through the Personal Information Protection Commission.
In a separate development, delivery riders have initiated a class-action lawsuit regarding an incident where approximately 135,000 pieces of personal information were leaked through restaurant POS device screens between August 2020 and November 2021. The leaked information includes real names, mobile phone numbers, and movement data. The lawsuit involves 67 plaintiffs.
During a press conference at the National Assembly, Koo Kyo-hyun of the Public Transport Union Rider Union stated, “At that time, Coupang claimed it had taken all measures to ensure such incidents would never happen again.” He added, “Exactly one year later, an astonishing 33 million pieces of personal information were leaked.”
Koo continued, “This is clear evidence that the company has taken no measures to address the security issues surrounding personal data leaks.” He criticized, “Yet Coupang continues to make profits in Korea while inflicting all the damage on the Korean people and lobbying in the U.S.”
Chairman Koo expressed, “Seeing this situation, I thought we cannot leave Coupang unchecked,” asserting, “Delivery riders will also hold Coupang accountable for the illegal acts it has committed against us.”
Most Commented