ENKR

Coupang customer data breach

Add to my breach check

Made public · about 37.55 million people

What leaked6

Replaceable

  • Building entrance code

Hard to replace

  • Mobile number
  • Home or delivery address
  • Email address

Permanent

  • Purchase or order history
  • Full name
  • Building entrance codeThe PIPC found 4,226 codes leaked unmasked. The address-list page masked the others, so for any one account it is possible, not confirmed.
  • Mobile numberdelivery address-book phone
  • Purchase or order historyorder history of 58,349 members · 272,470 orders: date, product, quantity, price; PIPC

To-dos5 · about 55 min in all

  1. Know the scam pattern: calls and texts that cite these leaked detailsabout 5 minfreeLimits harm from: scam calls, phishing messages
  2. Register as an exposed person with the FSSabout 10 minLimits harm from: scam calls (opens in a new tab)
  3. Block new loans and cards in your nameabout 10 minLimits harm from: scam calls (opens in a new tab)
  4. Change the building entrance codeabout 10 minStops: building entry
  5. Remove your address and phone from public profiles and tighten SNS privacyabout 20 minfreeLimits harm from: visits or contact at home

What happened next50 events

  1. Undetected 3 events296 days · show events
  2. Response 21 eventsNotice in 13 days · show events
  3. Remedy 2 eventsEnded · show events
  4. Penalty 16 eventsFine ₩423.6B · show events
  5. Disputes 8 eventsOngoing · show events
  1. Suit to cancel the PIPC penalty surcharges (breach and advertising cases) filed at Seoul Administrative Court with a stay application
  2. Coupang rejected the Consumer Dispute Mediation Committee's KRW 100,000 compensation proposal, so the mediation failed
  3. Consumer Dispute Mediation Committee decided KRW 100,000 (cash or Coupang Cash) per applicant for 50 group-mediation applicants
  4. Form 8-K: PIPC fines (~USD 278M breach, ~USD 132M advertising) and intent to seek relief in Seoul Administrative Court
  5. Criminal complaint among the sanctions in the breach case, whose listed violations include destroying evidence such as logs
45 more
  1. Corrective orders: key management and access control, breach notice to non-member data subjects, destruction policy and governance; publication orders
  2. Separate penalty surcharge of KRW 201.1 billion in the same decision for collecting off-site activity records without consent · not the breach itself
  3. Administrative fine of KRW 16.8 million for breach-notice and destruction violations
  4. Penalty surcharge of KRW 423.6 billion for the breach · security-measure failures
  5. PIPC found 33,222,472 members and at least 4,338,368 non-members affected; basic security failures, not advanced hacking
  6. Second derivative action filed in U.S. District Court, W.D. Wash.
  7. Coupang required to submit a remediation plan in February, implement it March-May; MSIT to check in June-July
  8. Joint investigation results: 33.67M name/email records leaked, delivery-list page viewed ~148M times; forged tokens, signing key not rotated after departure; late KISA report · fine planned
  9. Referred deletion of application logs (23 May to 2 June 2025) to investigators
  10. Consumer class action (negligence, unjust enrichment, New York law) filed in U.S. District Court, E.D.N.Y.
  11. Third leak report: 165,455 more accounts · delivery-list names, phones, addresses
  12. Vouchers worth KRW 50,000 per person in four kinds (Coupang 5,000, Coupang Eats 5,000, Coupang Travel 20,000, R.LUX 20,000) issued in the app to 33.79 million customers, withdrawn members includedEnded April 15, 2026
  13. Fourth PIPC call to notify non-member data subjects · after 3, 10 and 26 December 2025; not carried out
  14. Stockholder derivative action filed in U.S. District Court, N.D. Cal.
  15. Securities class action filed in U.S. District Court, W.D. Wash. · 2:26-cv-00047, class period 7 May to 16 December 2025
  16. Referred deletion of web logs after the data-preservation order to investigators
  17. Form 8-K/A filed: perpetrator identified, ~33M accounts accessed, voucher program
  18. Voucher compensation of about KRW 1.685 trillion announced for customers notified in late November 2025, issued from 15 January 2026
  19. Founder and board chair issued a first apology in his own name
  20. Coupang published the results of its own investigation of the hacker; PIPC later found they rested only on the hacker's statements, went out without fact-checking, and that the CPO had been excluded
25 more
  1. Securities class action filed in U.S. District Court, N.D. Cal. · 3:25-cv-10795
  2. Form 8-K Item 1.05 (material cybersecurity incident) filed with the SEC
  3. CEO of the Korean subsidiary resigned; parent's general counsel named interim CEO
  4. PIPC found partial compliance; called for a notice plan for non-members, 30+ day posting, and fixes to the liability-waiver terms and withdrawal process
  5. Police raided Coupang headquarters · first compulsory investigation
  6. Corrected notice ('leaked' instead of 'exposed', building entrance codes added) posted; texts to 33.7 million began
  7. Police · interim check: a review of about 116,000 home-intrusion, burglary and stalking cases found none linked to the Coupang breach so far
  8. Police · interim check: among about 22,000 smishing and voice-phishing reports, no suspected case found so far that used Coupang's leaked address or order data
  9. Emergency resolution urging Coupang to re-notify the incident as a 'leak' rather than an 'exposure' with every leaked item, notify people on delivery lists, expand its response team and report back within 7 days
  10. First damages suit filed at Seoul Central District Court, KRW 200,000 per plaintiff
  11. Government joint public-private investigation team activated
  12. Apology issued in the CEO's name; CEO apologised in person at the government meeting
  13. 'Personal information exposure notice' texts sent to customers
  14. Notice that about 33.7 million accounts were 'exposed'
  15. Second leak report to the PIPC: over 33 million accounts
  16. Second threat email to Coupang claiming 33M+ emails and 120M+ addresses
  17. Criminal complaint against an unidentified person filed with Seoul police cyber unit
  18. PIPC opened its investigation
  19. Coupang announced about 4,500 affected accounts
  20. First personal-data leak report to the PIPC · 4,536 members
5 more
  1. Intrusion reported to KISA (4,536 accounts) more than 24 hours after detection
  2. Coupang detected the intrusion through its own investigation · date as found by MSIT
  3. First threat emails with sample data sent to members · 9 to 17 November 2025
  4. Attacker's unauthorized access disabled upon discovery
  5. Intrusion began
Company
Coupang
When it happened
–
Company detected it
Made public
Notice
Leak confirmed
Affected
about 37.55 million people · PIPC decision June 11, 2026; 33.7M accounts in the first notice, +165,455 in February 2026

How the facts developed

  1. PIPC decision: about 37.55 million people. Penalty surcharge for the breach KRW 423.6 billion and an administrative fine of KRW 16.8 million. In the same decision, separate penalty surcharges: KRW 201.1 billion on Coupang for collecting online activity records without a legal basis, and KRW 248 million on CFS for unlawful collection and use of personal data and unlawful processing of sensitive data
  2. 165,455 further accounts (delivery lists: name, phone, address)
  3. Corrected notice after the PIPC's emergency resolution of December 3, 2025: '유출' instead of '노출', building entrance codes added. People on delivery lists who are not Coupang members were not notified (PIPC June 2026)
  4. First notice used '노출', listed name, email, delivery address book and some order info, and was posted for one to two days

Sources