ENKR

Coupang customer data breach

Add to my breach check

Made public · about 37.55 million people

What leaked6

Replaceable

  • Building entrance code

Hard to replace

  • Mobile number
  • Home or delivery address
  • Email address

Permanent

  • Purchase or order history
  • Full name
  • Building entrance codeThe PIPC found 4,226 codes leaked unmasked. The address-list page masked the others, so for any one account it is possible, not confirmed.
  • Mobile numberdelivery address-book phone
  • Purchase or order historyorder history of 58,349 members · 272,470 orders: date, product, quantity, price; PIPC

To-dos5 · about 55 min in all

  1. Know the scam pattern: calls and texts that cite these leaked detailsabout 5 minfreeLimits harm from: scam calls, phishing messages
  2. Register as an exposed person with the FSSabout 10 minLimits harm from: scam calls (opens in a new tab)
  3. Block new loans and cards in your nameabout 10 minLimits harm from: scam calls (opens in a new tab)
  4. Change the building entrance codeabout 10 minStops: building entry
  5. Remove your address and phone from public profiles and tighten SNS privacyabout 20 minfreeLimits harm from: visits or contact at home

What happened next50 events

  1. Undetected 3 events296 days · show events
  2. Response 21 eventsNotice in 13 days · show events
  3. Remedy 2 eventsEnded · show events
  4. Penalty 16 eventsFine ₩423.6B · Back to latest
  5. Disputes 8 eventsOngoing · show events

Penalty: 16 events

Back to latest
  1. Suit to cancel the PIPC penalty surcharges (breach and advertising cases) filed at Seoul Administrative Court with a stay application
  2. Criminal complaint among the sanctions in the breach case, whose listed violations include destroying evidence such as logs
  3. Corrective orders: key management and access control, breach notice to non-member data subjects, destruction policy and governance; publication orders
  4. Separate penalty surcharge of KRW 201.1 billion in the same decision for collecting off-site activity records without consent · not the breach itself
  5. Administrative fine of KRW 16.8 million for breach-notice and destruction violations
11 more
  1. Penalty surcharge of KRW 423.6 billion for the breach · security-measure failures
  2. PIPC found 33,222,472 members and at least 4,338,368 non-members affected; basic security failures, not advanced hacking
  3. Joint investigation results: 33.67M name/email records leaked, delivery-list page viewed ~148M times; forged tokens, signing key not rotated after departure; late KISA report · fine planned
  4. Referred deletion of application logs (23 May to 2 June 2025) to investigators
  5. Fourth PIPC call to notify non-member data subjects · after 3, 10 and 26 December 2025; not carried out
  6. Referred deletion of web logs after the data-preservation order to investigators
  7. PIPC found partial compliance; called for a notice plan for non-members, 30+ day posting, and fixes to the liability-waiver terms and withdrawal process
  8. Police raided Coupang headquarters · first compulsory investigation
  9. Emergency resolution urging Coupang to re-notify the incident as a 'leak' rather than an 'exposure' with every leaked item, notify people on delivery lists, expand its response team and report back within 7 days
  10. Government joint public-private investigation team activated
  11. PIPC opened its investigation
Company
Coupang
When it happened
–
Company detected it
Made public
Notice
Leak confirmed
Affected
about 37.55 million people · PIPC decision June 11, 2026; 33.7M accounts in the first notice, +165,455 in February 2026

How the facts developed

  1. PIPC decision: about 37.55 million people. Penalty surcharge for the breach KRW 423.6 billion and an administrative fine of KRW 16.8 million. In the same decision, separate penalty surcharges: KRW 201.1 billion on Coupang for collecting online activity records without a legal basis, and KRW 248 million on CFS for unlawful collection and use of personal data and unlawful processing of sensitive data
  2. 165,455 further accounts (delivery lists: name, phone, address)
  3. Corrected notice after the PIPC's emergency resolution of December 3, 2025: '유출' instead of '노출', building entrance codes added. People on delivery lists who are not Coupang members were not notified (PIPC June 2026)
  4. First notice used '노출', listed name, email, delivery address book and some order info, and was posted for one to two days

Sources