ENKR

Coupang customer data breach

Add to my breach check

Made public · about 37.55 million people

What leaked6

Replaceable

  • Building entrance code

Hard to replace

  • Mobile number
  • Home or delivery address
  • Email address

Permanent

  • Purchase or order history
  • Full name
  • Building entrance codeThe PIPC found 4,226 codes leaked unmasked. The address-list page masked the others, so for any one account it is possible, not confirmed.
  • Mobile numberdelivery address-book phone
  • Purchase or order historyorder history of 58,349 members · 272,470 orders: date, product, quantity, price; PIPC

To-dos5 · about 55 min in all

  1. Know the scam pattern: calls and texts that cite these leaked detailsabout 5 minfreeLimits harm from: scam calls, phishing messages
  2. Register as an exposed person with the FSSabout 10 minLimits harm from: scam calls (opens in a new tab)
  3. Block new loans and cards in your nameabout 10 minLimits harm from: scam calls (opens in a new tab)
  4. Change the building entrance codeabout 10 minStops: building entry
  5. Remove your address and phone from public profiles and tighten SNS privacyabout 20 minfreeLimits harm from: visits or contact at home

What happened next50 events

  1. Undetected 3 events296 days · Back to latest
  2. Response 21 eventsNotice in 13 days · show events
  3. Remedy 2 eventsEnded · show events
  4. Penalty 16 eventsFine ₩423.6B · show events
  5. Disputes 8 eventsOngoing · show events

Undetected: 3 events

Back to latest
  1. Coupang detected the intrusion through its own investigation · date as found by MSIT
  2. First threat emails with sample data sent to members · 9 to 17 November 2025
  3. Intrusion began
Company
Coupang
When it happened
–
Company detected it
Made public
Notice
Leak confirmed
Affected
about 37.55 million people · PIPC decision June 11, 2026; 33.7M accounts in the first notice, +165,455 in February 2026

How the facts developed

  1. PIPC decision: about 37.55 million people. Penalty surcharge for the breach KRW 423.6 billion and an administrative fine of KRW 16.8 million. In the same decision, separate penalty surcharges: KRW 201.1 billion on Coupang for collecting online activity records without a legal basis, and KRW 248 million on CFS for unlawful collection and use of personal data and unlawful processing of sensitive data
  2. 165,455 further accounts (delivery lists: name, phone, address)
  3. Corrected notice after the PIPC's emergency resolution of December 3, 2025: '유출' instead of '노출', building entrance codes added. People on delivery lists who are not Coupang members were not notified (PIPC June 2026)
  4. First notice used '노출', listed name, email, delivery address book and some order info, and was posted for one to two days

Sources