Coupang

Disclosed Nov 29, 202533,700,000 affectedConfirmed

Former employee took data of 34M customers; record KRW 624B PIPC fine

A months-long breach let a former Coupang employee obtain names, emails, shipping addresses, phone numbers and order histories of more than 34 million South Korean customers. The Personal Information Protection Commission imposed a record fine of about KRW 624 billion (over USD 400M), which Coupang said it would challenge.

What is known

People affected	33,700,000 (as reported by the organization)
Disclosed	Nov 29, 2025
Discovered	Nov 18, 2025
Attack	Insider
Data exposed	NamesEmailsPhone numbersAddressesOther
Sector	Retail · US
Status	Confirmed
Lawsuit or fine	KRW 624B PIPC fine (June 2026), being challenged (about $400M)

Sources

SEC filingsec.gov

Coupang, Inc. Form 8-K, Item 1.05 (2025-12-16)

SEC filingsec.gov

Coupang, Inc. Form 8-K/A, Item 1.05 (2025-12-29)

Newstechcrunch.com

Korea's Coupang says data breach exposed nearly 34M customers' personal information

Newsbleepingcomputer.com

Coupang to split $1.17 billion among 33.7 million data breach victims

Newstechcrunch.com

South Korea hits Coupang with $400M+ fine for data breach that affected millions

Notices filed

TotalNov 29, 2025

Research33,700,000 people

TotalDec 1, 2025

Research33,700,000 people

TotalDec 16, 2025

SEC 8-KCount not stated

TotalDec 29, 2025

SEC 8-KCount not stated

History of this record

fine_usd2026-09-25

empty to 400000000by seedSource

lawsuit2026-09-25

empty to KRW 624B PIPC fine (June 2026), being challengedby seedSource

summary2026-09-25

Coupang said a months-long breach discovered on November 18, 2025 exposed names, emails, phone numbers, shipping addresses and some order histories of about 33.7 million Korean accounts; it attributed it to a former employee, its CEO resign to A months-long breach let a former Coupang employee obtain names, emails, shipping addresses, phone numbers and order histories of more than 34 million South Korean customers. The Personal Information Protection Commission imposed a record fby seedSource

title2026-09-25

Former employee accesses 33.7 million Coupang customer accounts to Former employee took data of 34M customers; record KRW 624B PIPC fineby seedSource

sector2026-09-25

other to retailby seedSource

attack2026-09-25

unknown to insiderby seedSource

data_types2026-09-25

[] to ["names","emails","phone","addresses","other"]by seedSource

records_basis2026-09-25

empty to organizationby seedSource

records2026-09-25

empty to 33700000by seedSource

disclosed2026-09-25

2025-12-16 to 2025-11-29by seedSource

discovered2026-09-25

empty to 2025-11-18by seedSource

summary2026-09-25

empty to Coupang said a months-long breach discovered on November 18, 2025 exposed names, emails, phone numbers, shipping addresses and some order histories of about 33.7 million Korean accounts; it attributed it to a former employee, its CEO resignby seedSource

title2026-09-25

Material cybersecurity incident reported to the SEC (8-K Item 1.05) to Former employee accesses 33.7 million Coupang customer accountsby seedSource

Added2026-09-25

First recordedby backfillSource

First seen 2026-09-25 (SEC 8-K), confirmed by SEC 8-K. Record counts are as reported. Not legal advice.

Everything about Coupang