Coupang
Disclosed Nov 29, 202510 months ago33,700,000 affectedConfirmed
Former employee took data of 34M customers; record KRW 624B PIPC fine
A months-long breach let a former Coupang employee obtain names, emails, shipping addresses, phone numbers and order histories of more than 34 million South Korean customers. The Personal Information Protection Commission imposed a record fine of about KRW 624 billion (over USD 400M), which Coupang said it would challenge.
What is known
| People affected | 33,700,000 (as reported by the organization) |
|---|---|
| Disclosed | Nov 29, 2025 |
| Discovered | Nov 18, 2025 |
| Attack | Insider |
| Data exposed | Names, Emails, Phone numbers, Addresses, Other |
| Sector | Retail · US |
| Status | Confirmed |
| Lawsuit or fine | KRW 624B PIPC fine (June 2026), being challenged (about $400M) |
Sources
| Source | |
|---|---|
| Coupang, Inc. Form 8-K, Item 1.05 (2025-12-16)sec.gov · SEC filing | SEC filing |
| Coupang, Inc. Form 8-K/A, Item 1.05 (2025-12-29)sec.gov · SEC filing | SEC filing |
| Korea's Coupang says data breach exposed nearly 34M customers' personal informationtechcrunch.com · News | News |
| Coupang to split $1.17 billion among 33.7 million data breach victimsbleepingcomputer.com · News | News |
| South Korea hits Coupang with $400M+ fine for data breach that affected millionstechcrunch.com · News | News |
Notices filed
History of this record
- 2026-09-25 · fine_usd: empty to 400000000 · seed source
- 2026-09-25 · lawsuit: empty to KRW 624B PIPC fine (June 2026), being challenged · seed source
- 2026-09-25 · summary: Coupang said a months-long breach discovered on November 18, 2025 exposed names, emails, phone numbers, shipping addresses and some order histories of about 33.7 million Korean accounts; it attributed it to a former employee, its CEO resign to A months-long breach let a former Coupang employee obtain names, emails, shipping addresses, phone numbers and order histories of more than 34 million South Korean customers. The Personal Information Protection Commission imposed a record f · seed source
- 2026-09-25 · title: Former employee accesses 33.7 million Coupang customer accounts to Former employee took data of 34M customers; record KRW 624B PIPC fine · seed source
- 2026-09-25 · sector: other to retail · seed source
- 2026-09-25 · attack: unknown to insider · seed source
- 2026-09-25 · data_types: [] to ["names","emails","phone","addresses","other"] · seed source
- 2026-09-25 · records_basis: empty to organization · seed source
- 2026-09-25 · records: empty to 33700000 · seed source
- 2026-09-25 · disclosed: 2025-12-16 to 2025-11-29 · seed source
- 2026-09-25 · discovered: empty to 2025-11-18 · seed source
- 2026-09-25 · summary: empty to Coupang said a months-long breach discovered on November 18, 2025 exposed names, emails, phone numbers, shipping addresses and some order histories of about 33.7 million Korean accounts; it attributed it to a former employee, its CEO resign · seed source
- 2026-09-25 · title: Material cybersecurity incident reported to the SEC (8-K Item 1.05) to Former employee accesses 33.7 million Coupang customer accounts · seed source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (SEC 8-K), confirmed by SEC 8-K. Record counts are as reported. Not legal advice.