Coupang, a South Korean company, reports that a data breach has exposed personal information of nearly 34 million customers.

South Koreas leading e-commerce company, Coupang, announced over the weekend that the personal information of nearly 34 million customers had been exposed in a data breach that persisted for over five months. Initially, the company detected unauthorized access affecting 4,500 user accounts on November 18, but further investigation revealed the breach actually impacted approximately 33.7 million accounts.

The compromised information included customers names, email addresses, phone numbers, shipping addresses, and certain order histories. More sensitive details, such as payment information, credit card numbers, and login credentials, were not affected and remain secure, according to Coupang.

Coupang has reported the breach to the Korea Internet Security Agency (KISA), the Personal Information Protection Commission (PIPC), and the National Police Agency. The company is also known for its Rocket Delivery service in South Korea and operates marketplaces in Japan and Taiwan.

A company spokesperson confirmed to TechCrunch that the investigation found no evidence that consumer data from Coupang Taiwan or the Rocket Now service was compromised. Coupang stated that the unauthorized access likely began on June 24, 2025, via foreign servers. In response, the company blocked the access route, enhanced internal monitoring, and engaged top independent security experts.

Authorities have identified at least one suspecta former Chinese Coupang employee currently abroadafter initiating an investigation following the November 18 report. This incident adds to a series of cybersecurity issues in South Korea this year, with Coupang previously experiencing data breaches exposing both customer and delivery personnel information. Earlier breaches occurred between 2020 and 2021, and most recently in December 2023, when its seller management system leaked data of over 22,000 customers.

Author's Commentary: Coupang Data Breach Raises Persistent Security Concerns

The recent disclosure by Coupang, affecting nearly 34 million customer accounts, underscores the scale and persistence of cybersecurity challenges facing major e-commerce platforms. Although the company initially detected the breach in November 2025 affecting 4,500 accounts, the full scope—spanning over five months—reveals deeper vulnerabilities in monitoring and incident detection.

Importantly, Coupang confirmed that sensitive financial information, such as payment details and login credentials, remained secure. This limits the immediate financial risk to customers but does not mitigate potential privacy violations resulting from exposure of names, emails, phone numbers, and shipping addresses.

Authorities have already identified a suspect, a former employee currently abroad, indicating a targeted insider element in this breach. Coupang’s response—blocking the access route, enhancing monitoring, and engaging top security experts—is necessary, yet it reflects a reactive rather than preventive posture. Repeated incidents in recent years suggest systemic issues in the company’s data protection protocols.

This breach should serve as a reminder that even market-leading companies with advanced logistics services are not immune to extended, high-impact cyberattacks. Continuous, proactive security measures, including real-time monitoring and stringent access controls, remain critical to protect customer data and restore trust.

Sources:

• Korea’s Coupang says data breach exposed nearly 34M customers’ personal information