Coupang Data Breach: Former Employee Confesses to Information Leak

On December 25, 2023, South Korean online retailer Coupang reported a significant data breach involving the personal information of approximately 3,000 customers out of its 33 million accounts. The company identified a former employee as the perpetrator, who confessed to accessing and storing sensitive data, including names, emails, addresses, and phone numbers. Coupang stated that the employee deleted the information and disposed of the devices used in the breach.

Coupang Apprehends Customer Data Leaker: "Acted Alone, Disposed of Laptop in Stream" (Comprehensive)The Straits Times

The former employee allegedly acquired a security key during their employment, which facilitated unauthorized access to customer accounts. According to Coupang, the employee utilized a personal desktop PC and a MacBook Air to extract data from 3,000 accounts, including 2,609 shared entrance access codes. Following the incident, the employee destroyed the devices and discarded them in a nearby stream. Coupang engaged cybersecurity firms Mandiant, Palo Alto Networks, and Ernst & Young to investigate the breach, confirming that there was no external transmission of the leaked information.

Coupang Apprehends Customer Data Leaker: "Acted Alone, Disposed of Laptop in Stream" (Comprehensive)

Coupang emphasized that all customer data related to the breach was deleted and that no information was transmitted to third parties. The company expressed its commitment to addressing customer concerns, stating, "We take full responsibility for how much concern the recent personal information breach has caused our customers." Additionally, South Korea's Science Ministry is leading an ongoing investigation into the incident, expressing dissatisfaction with Coupang's public disclosure of the breach details before official confirmation.

Coupang Apprehends Customer Data Leaker: "Acted Alone, Disposed of Laptop in Stream" (Comprehensive)The Straits Times

In light of the breach, South Korean President Lee Jae Myung has called for stricter penalties against Coupang for corporate negligence, highlighting the severity of the incident as one of the country's worst data breaches. The ministry's complaint regarding Coupang's unilateral disclosure indicates a tension between the company and regulatory authorities.

The Straits TimesCoupang Apprehends Customer Data Leaker: "Acted Alone, Disposed of Laptop in Stream" (Comprehensive)

While Coupang asserts that all leaked information has been deleted and that there was no external transmission, the ongoing investigation by the Science Ministry has yet to confirm these claims. The ministry's involvement suggests that further scrutiny may reveal additional details about the breach and the company's handling of the situation.

The Straits Times

• “We sincerely apologize for the worry and inconvenience experienced by so many people as a result of the Coupang data breach incident.” — Coupang

• “According to our investigation so far, the perpetrator only stored limited customer information from 3,000 accounts, and subsequently deleted all of it.” — Coupang

• “We take full responsibility for how much concern the recent personal information breach has caused our customers,” — Coupang

This incident underscores the vulnerabilities in data security practices and the potential consequences of corporate negligence in safeguarding customer information.