Coupang apologizes over data breach affecting 33.7 million users

Coupang, South Korea’s largest online retailer, apologized after revealing that personal data from 33.7 million customer accounts was accessed without authorisation.

CEO Park Dae-jun said the company was sorry for the inconvenience caused, adding the statement in a notice on its website.

Coupang said it discovered the breach on November 18 and reported it to authorities.

The incident began on June 24 via overseas servers and exposed names, email addresses, phone numbers, shipping addresses, and certain order histories, but not payment details or login credentials.

The government has opened a review into whether Coupang followed data protection requirements, and a former employee based overseas is reportedly under investigation.

The Korea Internet & Security Agency also advised affected users to watch for phishing attempts.

Coupang, which had 24.7 million active product commerce customers in Q3 2025, said it is working with law enforcement and regulators as the investigation continues.

🔗 Source: Reuters

🧠 Food for thought

Implications, context, and why it matters.

South Korea’s Personal Information Protection Commission (PIPC) levies large privacy fines; outcomes vary by case

Meta received a 21.6232 billion Korean won (KRW) fine, about $15.67 million, for collecting plus sharing sensitive data from about 980,000 users without explicit consent and was ordered to improve security plus handling of access requests 1.
Incruit, a South Korean job portal, was fined 400 million KRW (about $300,000) after a 7.27 million-record breach 2.
Coupang’s breach hit 33.7 million accounts, larger than prior cases. The Personal Information Protection Act (PIPA) gives the PIPC discretion on penalties, so the outcome hinges on findings.
The breach started June 24 and was discovered November 18. PIPA requires notice once an organization is aware, and PIPC reviews timeliness.

Coupang’s breach may spur security buying amid South Korea’s cybersecurity market growth

By 2030 the market is forecast at $12.88 billion on a 12.39% Compound Annual Growth Rate (CAGR); healthcare leads at 15.6% CAGR while e-commerce and retail favor managed security services growing 14.79% for 24×7 monitoring plus incident response 3.
Local players include AhnLab (security software vendor), SK Shieldus (managed security services provider) and Samsung SDS (Samsung’s IT services arm) 3. Foreign toolsets lift total cost of ownership 15–25% over domestic options, steering spend to these firms 3.
Investors should watch identity-centric solutions (tools that verify users as well as devices), plus zero-trust architectures (a security model that assumes no implicit trust). These capture most growth 3.