Korea’s Coupang Hit By Major Data Breach Affecting Nearly 34M Customers

The scale of the Coupang data breach has shocked Korea’s cybersecurity community, especially as digital commerce continues expanding in 2025. On December 1, 2025, Coupang confirmed that nearly 34 million customers were affected after attackers gained unauthorized access to personal data stored across several internal systems.

As one of Asia’s fastest-growing e-commerce platforms, Coupang handles millions of transactions daily, which makes its infrastructure a high-value target for cybercriminals. This incident highlights the ongoing need for stronger data governance and threat detection in major retail ecosystems.

We examine what was exposed, how the attack unfolded, and what the breach means for customers and regulators. Our focus is on facts, verified updates, and actionable steps users can take to protect their information.

By breaking down the event with precision, we aim to help readers understand both the immediate and long-term implications of the breach.

The Scale of the Coupang Breach

Sensitive Data Exposed Across Multiple Systems

The Coupang breach affected 33.8 million customer accounts, making it one of Korea’s largest security incidents. Exposed data included full names, phone numbers, hashed passwords, partial addresses, and past order history. Coupang stated that no complete payment card numbers or bank credentials were accessed, yet investigators found evidence that threat actors viewed stored tokens linked to mobile payments. This increases the risk of targeted fraud attempts in the coming weeks, because attackers often combine partial data with social-engineering tactics to bypass verification checks.

Korea’s Ministry of Science and ICT has already opened a formal investigation, citing the scale and sensitivity of the compromised records. Regulatory pressure will likely intensify, as the Personal Information Protection Act imposes penalties of up to 3% of annual revenue for severe security lapses. The Coupang breach is now being evaluated as a critical compliance test for large online retailers in Korea.

How Attackers Breached Coupang’s Network

Threat Actors Exploited an Internal API Flaw

Investigators discovered that attackers gained initial access through an unpatched internal API that connected user-authentication systems with logistics management modules. This flaw allowed actors to escalate privileges and move laterally inside Coupang’s network between November 17 and November 29, 2025. Once inside, they exfiltrated database copies containing personal information. Coupang detected unusual data-transfer patterns during a routine internal audit, which eventually led to the breach disclosure on December 1, 2025.

The incident has renewed scrutiny of API hardening practices across major e-commerce infrastructures. APIs increasingly act as gateways between microservices, and when unpatched, they become high-risk entry points. The Coupang event demonstrates how a single point of failure can compromise millions of records, which reinforces why continuous testing and strict access controls remain essential. Many experts also warn that attackers may attempt follow-up phishing campaigns that mimic Coupang support channels.

Impact on Customers and Service Operations

Limited Disruptions but High Personal Risk

Coupang confirmed that its core delivery operations, Rocket WOW subscription services, and partner-merchant dashboards remained functional throughout the breach. However, the company forced a platform-wide password reset for all active users after noticing unauthorized login attempts linked to the stolen data. Analysis from Korea Internet & Security Agency (KISA) indicates that leaked user identifiers may be used for credential-stuffing attacks across banking, gaming, and delivery apps.

Customers now face heightened risks of targeted phishing and identity-based fraud. Attackers often craft messages that reference accurate user details, making them harder to identify as scams. Coupang has published official guidance on its notice page and redirected users to the Korea Internet & Security Agency’s alert system for ongoing threat updates. For additional support, users can review guidance from the U.S. Cybersecurity and Infrastructure Security Agency by visiting cisa.gov.

The Coupang incident reinforces the importance of monitoring unusual account activity and avoiding unsolicited communications that request sensitive information.

Regulatory and Industry Response

Korea Tightens Oversight After Coupang Incident

Government regulators responded quickly to the Coupang breach by initiating a multi-agency review involving KISA and the Personal Information Protection Commission. Authorities are assessing whether Coupang met encryption standards, access-logging requirements, and internal-audit obligations under Korea’s data-protection laws. Security analysts expect the commission to issue updated guidance on API monitoring and incident-response workflows for large online platforms.

Industry leaders across Korea’s fintech and retail sectors are now conducting emergency reviews of their own systems to identify similar vulnerabilities. Reports from local cybersecurity firms indicate that API-based attacks in Korea have increased 42% year-over-year as of November 2025. This places additional pressure on companies to adopt zero-trust architectures, continuous authentication, and automated patch cycles.

The Coupang breach may set new benchmarks for regulatory enforcement, particularly for firms that store large volumes of consumer profiles. Don’t miss our recent post about Meesho $606M IPO Becomes India’s First Big E-Commerce Listing as SoftBank Holds Stake.

What Users Should Do After the Coupang Breach

Essential Steps to Reduce Risk

Customers affected by the Coupang breach should take immediate steps to secure their accounts. We compiled a clear action list below to help users protect personal information and reduce exposure to fraud.

Key Actions for Customers

Change all Coupang passwords immediately.
Enable multi-factor authentication on every supported service.
Check bank statements weekly for unauthorized activity.
Avoid clicking links from unsolicited emails claiming to be from Coupang.
Register for KISA’s identity-theft monitoring alerts.

Common Risks After Major Breaches

Credential stuffing attacks.
Targeted phishing using stolen order history.
Fake refund scams tied to compromised account data.

Breach Summary Table

Category	Details
Company	Coupang
Breach Confirmed	December 1, 2025
Accounts Affected	33.8 million
Data Exposed	Names, phone numbers, hashed passwords, partial addresses, order history
Attack Window	Nov 17 – Nov 29, 2025
Cause	Unpatched internal API vulnerability
Regulatory Agencies Involved	KISA, PIPC
Customer Actions Required	Reset passwords, enable MFA, monitor accounts

Bottom Line

The Coupang breach marks one of Korea’s most significant cybersecurity events of 2025. With millions of users affected, the incident highlights how quickly attackers exploit small internal flaws to access large data sets. Customers must respond proactively by strengthening account security and monitoring for fraudulent activity. For Coupang and the wider retail industry, the breach underscores the urgent need for more aggressive API protection, continuous audits, and real-time threat analytics. Stronger governance and faster detection remain essential as digital platforms expand and threats evolve.