South Korea's Coupang suffers data breach affecting 33.7 million customer accounts

Coupang’s CEO, Park Dae-Jun has offered an apology to 33.7 million of the company’s customers who had their accounts compromised in a recent breach. 

South Korea’s largest online retailer Coupang suffered a data breach affecting 33.7 million customer accounts, exposing names, phone numbers, email addresses, shipping addresses, and order histories.

Coupang is currently being investigated by South Korean regulators to determine whether the company had any fault in the breach. 

Coupang confirms 33.7 million breached accounts 

South Korean e-commerce giant Coupang confirmed that the personal information from 33.7 million customer accounts was compromised through unauthorized access. The breach affects nearly two-thirds of South Korea’s total population.

“We sincerely apologise once again for causing our customers inconvenience” Coupang’s CEO Park Dae-jun said in a statement posted on the company’s website. 

The company discovered the breach on November 18 and initially reported that approximately 4,500 customer accounts were affected. However, subsequent investigations revealed that the number of compromised accounts is up to 33.7 million.

The exposed data includes names, email addresses, phone numbers, shipping addresses, and certain order histories, but does not include even more sensitive information like payment details or login credentials. 

Cybersecurity experts have warned that the compromised data could still be used for identity theft, phishing attacks, and other malicious purposes.

The company reported that it had 24.7 million active commercial users in the third quarter, meaning the breach might have affected data from former customers and dormant accounts. 

Some of Coupang’s affected customers are reportedly preparing a class-action lawsuit in response to the incident.

The Minister of Science and ICT, Bae Kyung-hoon confirmed that the government held an emergency meeting and is investigating whether Coupang violated safety rules regarding personal information protection. 

The Ministry of Science and ICT formed a joint investigation team to analyze the cause of the incident.

According to reports from Yonhap News Agency, a former Chinese employee at Coupang is suspected to be behind the breach, but that individual has left the country. Coupang filed a formal complaint earlier this month with the police, but did not name a suspect in its filing.

Frequent cyber attacks in South Korea 

Earlier this year, SK Telecom, South Korea’s largest mobile carrier, experienced its own devastating breach that exposed phone numbers, subscriber identification numbers, and SIM authentication keys belonging to 23.2 million users.

In August, South Korea’s privacy regulator imposed a record fine of 134.8 billion won ($97.2 million) on SK Telecom, stating that the company had “basic security failures and poor management” that left it vulnerable to cyber attacks. 

The regulator found that SK Telecom failed to encrypt 26.1 million SIM authentication keys, leaving them exposed in plain-text databases, and ignored intrusion detection logs while not applying available security patches. 

Other major companies have faced similar issues, such as the Telecommunications firm KT Corp. and financial services company Lotte Card, which both announced data leaks in recent months.

South Korean regulators have shown that they expect companies to take customer protection seriously with the record fine imposed on SK Telecom earlier this year. Coupang could face similar consequences depending on the findings of the ongoing investigation.

Coupang has stated that it is cooperating fully with authorities and has blocked the unauthorized access route. The company’s internal monitoring systems have also been reportedly strengthened.

Get seen where it counts. Advertise in Cryptopolitan Research and reach crypto’s sharpest investors and builders.