Fast Facts

• 33.7 million Coupang customer accounts exposed in a sweeping data breach.
• Breached information includes names, phone numbers, emails, addresses, and order details-but not payment data or passwords.
• Incident occurred in June 2025 but was only discovered in November 2025.
• Initial reports suggest a former employee exploited lingering system access.
• Authorities and affected customers have been notified; investigation is ongoing.

The Breach Unveiled

Imagine millions of shopping carts suddenly laid bare-names, addresses, and purchases all exposed under a harsh, digital spotlight. That’s the reality facing Coupang, South Korea’s Amazon-like retail powerhouse, after a breach that has sent shockwaves through Asia’s tech scene. On November 18, 2025, Coupang uncovered unauthorized access affecting thousands of accounts, only to soon realize the true scale: nearly the entire population of South Korea had some personal data leaked.

How Did It Happen?

While Coupang’s official statements remain tight-lipped on the technical details, local press-including The Investor-report the breach traces back to a former employee who retained valid access tokens. Think of these tokens as digital keys; if not quickly revoked after someone leaves, they can still unlock company doors. Using these forgotten keys, the insider is believed to have slipped in and siphoned data undetected for months.

Though payment information and passwords were reportedly untouched, the exposed trove-names, emails, addresses, and order histories-still hands cybercriminals a treasure map for scams, phishing, and identity theft.

Patterns and Parallels

This breach is not an isolated incident. Earlier in 2025, SK Telecom, another South Korean giant, disclosed a malware attack that exposed sensitive SIM card data of 27 million subscribers. Both cases reveal a worrying trend: high-tech companies, even those with billions in revenue and armies of IT staff, remain vulnerable to both external and insider threats-especially when basic digital hygiene, like promptly revoking access, is overlooked.

Coupang’s rapid growth-from a local startup to a public company listed on the New York Stock Exchange-may have made it a juicy target, but it also highlights a global dilemma: how to balance convenience, scale, and security in a world where every click and order creates a potential opening for cybercrime.

What’s Next for Customers and the Industry?

Coupang has notified authorities and promised to alert impacted customers directly. The company urges vigilance: watch for suspicious emails, calls, or texts impersonating the brand. For the wider market, this episode is a stark reminder that the weakest link is often human-whether through error, oversight, or outright malice.

As digital commerce deepens its roots in everyday life, the question lingers: how many more breaches will it take before companies-and customers-treat data security as seriously as the products they buy and sell?