Coupang denies blackmail claims over customer data breach

Coupang has denied allegations that a suspect involved in a data breach attempted to extort the company by threatening to reveal customer information.

The company said there is no evidence of any payment demand linked to the breach, which reportedly involved about 3,000 customers purchasing adult products.

The allegations were made during a parliamentary session by Rep. Kim Seung-won, who raised concerns about the exploitation of personal data.

The Ministry of Science and ICT reported that 33.7 million user records, including names and email addresses, were accessed through Coupang’s systems, with over 148 million visits to the delivery address page.

Coupang clarified that access to certain building entrance codes was limited to 2,609 accounts and that no highly sensitive customer data, such as payment details or passwords, was accessed.

The company also said cybersecurity firms are monitoring for any misuse of leaked data, with no evidence of secondary harm detected.

🔗 Source: The Korea Herald

🧠 Food for thought

Implications, context, and why it matters.

The extortion claim sits inside a wider geopolitical fight

The extortion allegation raised in South Korea’s parliament lands in a larger argument about how South Korean regulators handle Coupang, a company with its global headquarters in Seattle, which can cast the matter as a cross-border dispute 1.
Major U.S. investors including Greenoaks and Altimeter say South Korea is treating the company unfairly. They filed a notice of intent with South Korea’s Ministry of Justice to pursue investor–state dispute settlement (ISDS) arbitration, a process that lets foreign investors bring claims against governments, under the U.S.-Korea Free Trade Agreement 2.
The investors claim regulators are attacking the firm to help local rivals. They point to fines capped at 3% of revenue under current law, which they put at more than $800 million for Coupang, plus a proposal from some lawmakers to lift the cap to 10% and apply it retroactively. Even if that proposal passes, it would not apply to Coupang because the breach occurred before the rules changed 1.

A data breach turns into a test for tech nationalism

The case raises concerns around digital sovereignty, the idea that countries should control data and digital infrastructure within their borders. Foreign tech companies can face tougher review than domestic champions.
Investors say the government treated breaches at local firms differently, including incidents involving KakaoPay and SK Telecom. They argue those companies received lighter penalties even after major events 2.
Regulators have taken a hard line, and lawmakers have floated retroactive punishment. That mix can spook overseas investment in South Korea’s tech sector by adding uncertainty 1.
The clash now spills beyond a company crisis. It fuels U.S. claims of unfair treatment and raises the odds of wider trade friction between the two countries 1.