South Korean e-commerce giant Coupang announced over the weekend that a data breach has compromised the personal information of nearly 34 million customers in the country. The incident went undetected for more than five months.
The company initially discovered unauthorized access to about 4,500 user accounts on November 18. However, a deeper investigation revealed the true scale of the breach, affecting approximately 33.7 million customer accounts.
The exposed data includes customer names, email addresses, phone numbers, shipping addresses, and certain order histories. Coupang stated that more sensitive information, such as payment details, credit card numbers, and login credentials, was not compromised and remains secure.
Coupang has reported the incident to Korean authorities, including the Korea Internet Security Agency, the Personal Information Protection Commission, and the National Police Agency. According to the company’s investigation, the unauthorized access began on June 24, 2025, via overseas servers. Coupang says it has since blocked the access route, strengthened internal monitoring, and hired experts from a leading independent security firm.
Police have identified at least one suspect, a former Chinese Coupang employee now living abroad, following an investigation launched after the November 18 complaint.
Coupang is one of South Korea’s largest e-commerce platforms and also operates a quick-commerce service called Rocket Delivery. The company also runs marketplaces in Japan and Taiwan. A Coupang spokesperson confirmed that data from customers in Taiwan and users of its Rocket Now service were not affected by this breach.
This event is the latest in a series of cybersecurity incidents in South Korea this year. Coupang itself has experienced several data breaches in the past, including leaks between 2020 and 2021 that exposed customer and delivery driver information. Most recently, in December 2023, a breach of its seller management system compromised the personal information of more than 22,000 customers.