Coupang Data Breach: What You Need to Know About Customer Information Security in 2023

On the 10th, Coupang issued a statement addressing the data incident investigated by the public-private joint investigation team. The company emphasized that while all employees had access to over 33 million customer account records, only about 3,000 pieces of information were actually stored, and no cases of secondary damage have been confirmed.
According to Coupang, the former employee, who was of Chinese nationality, used self-created software to perform approximately 140 million automated queries, accessing user data for about 33.7 million individuals.
Coupang stated that all devices used in the breach have been recovered. The forensic evidence obtained aligns with the sworn confession of the former employee, who admitted to saving data from only about 3,000 accounts before deleting it. The company added that since December 23, 2025, the public-private joint investigation team and regulatory authorities, including the Personal Information Protection Commission, have possessed all recovered devices and confirmed through forensic analysis that no personal information of Korean users remains stored on those devices.
━
No Access to Sensitive Information Such as Financial Data or Passwords
Coupang clarified the scope of the leaked information. The company stated that the data accessed by the former employee included customer names, email addresses, phone numbers, shipping addresses, limited order histories, and a small number of public entrance codes. They emphasized that highly sensitive customer information such as payment details, financial data, user IDs, passwords, or government-issued identification was not accessed. This was verified through security logs from Akamai, the cloud platform provider.
Regarding public entrance codes, Coupang reported that 2,609 cases included these codes among the accessed accounts. This was confirmed through Akamai’s security logs and user data analysis, which were shared with authorities on December 23, 2025.
The company also addressed concerns about potential secondary damage resulting from the data leak. Coupang stated that independent security firm CNS and several other independent internet security companies have continuously monitored the dark web, deep web, and Telegram, finding no activities related to secondary damage.
Furthermore, Coupang explained that on December 5, 2025, the National Police Agency’s investigation team conducted a thorough analysis of about 22,000 cases related to voice phishing and approximately 116,000 cases of serious crimes such as home invasion. The police announced that there were no secondary damage cases involving the types of information leaked from Coupang. While the police later stated that it is currently difficult to determine whether secondary damage has occurred, they have not confirmed or reported any secondary damage cases to date.
A Coupang spokesperson stated, “We are committed to protecting customer data and maintaining transparency in our information disclosure. We will fully cooperate with the government investigation. We deeply regret any concerns caused by this incident and sincerely apologize to all those affected.”