ENKR

Coupang customer data breach

Add to my breach check

Made public · about 37.55 million people

What leaked6

Replaceable

  • Building entrance code

Hard to replace

  • Mobile number
  • Home or delivery address
  • Email address

Permanent

  • Purchase or order history
  • Full name
  • Building entrance codeThe PIPC found 4,226 codes leaked unmasked. The address-list page masked the others, so for any one account it is possible, not confirmed.
  • Mobile numberdelivery address-book phone
  • Purchase or order historyorder history of 58,349 members · 272,470 orders: date, product, quantity, price; PIPC

To-dos5 · about 55 min in all

  1. Know the scam pattern: calls and texts that cite these leaked detailsabout 5 minfreeLimits harm from: scam calls, phishing messages
  2. Register as an exposed person with the FSSabout 10 minLimits harm from: scam calls (opens in a new tab)
  3. Block new loans and cards in your nameabout 10 minLimits harm from: scam calls (opens in a new tab)
  4. Change the building entrance codeabout 10 minStops: building entry
  5. Remove your address and phone from public profiles and tighten SNS privacyabout 20 minfreeLimits harm from: visits or contact at home

What happened next50 events

  1. Undetected 3 events296 days · show events
  2. Response 21 eventsNotice in 13 days · Back to latest
  3. Remedy 2 eventsEnded · show events
  4. Penalty 16 eventsFine ₩423.6B · show events
  5. Disputes 8 eventsOngoing · show events

Response: 21 events

Back to latest
  1. Form 8-K: PIPC fines (~USD 278M breach, ~USD 132M advertising) and intent to seek relief in Seoul Administrative Court
  2. Coupang required to submit a remediation plan in February, implement it March-May; MSIT to check in June-July
  3. Third leak report: 165,455 more accounts · delivery-list names, phones, addresses
  4. Form 8-K/A filed: perpetrator identified, ~33M accounts accessed, voucher program
  5. Founder and board chair issued a first apology in his own name
16 more
  1. Coupang published the results of its own investigation of the hacker; PIPC later found they rested only on the hacker's statements, went out without fact-checking, and that the CPO had been excluded
  2. Form 8-K Item 1.05 (material cybersecurity incident) filed with the SEC
  3. CEO of the Korean subsidiary resigned; parent's general counsel named interim CEO
  4. Corrected notice ('leaked' instead of 'exposed', building entrance codes added) posted; texts to 33.7 million began
  5. Police · interim check: a review of about 116,000 home-intrusion, burglary and stalking cases found none linked to the Coupang breach so far
  6. Police · interim check: among about 22,000 smishing and voice-phishing reports, no suspected case found so far that used Coupang's leaked address or order data
  7. Apology issued in the CEO's name; CEO apologised in person at the government meeting
  8. 'Personal information exposure notice' texts sent to customers
  9. Notice that about 33.7 million accounts were 'exposed'
  10. Second leak report to the PIPC: over 33 million accounts
  11. Second threat email to Coupang claiming 33M+ emails and 120M+ addresses
  12. Criminal complaint against an unidentified person filed with Seoul police cyber unit
  13. Coupang announced about 4,500 affected accounts
  14. First personal-data leak report to the PIPC · 4,536 members
  15. Intrusion reported to KISA (4,536 accounts) more than 24 hours after detection
  16. Attacker's unauthorized access disabled upon discovery
Company
Coupang
When it happened
–
Company detected it
Made public
Notice
Leak confirmed
Affected
about 37.55 million people · PIPC decision June 11, 2026; 33.7M accounts in the first notice, +165,455 in February 2026

How the facts developed

  1. PIPC decision: about 37.55 million people. Penalty surcharge for the breach KRW 423.6 billion and an administrative fine of KRW 16.8 million. In the same decision, separate penalty surcharges: KRW 201.1 billion on Coupang for collecting online activity records without a legal basis, and KRW 248 million on CFS for unlawful collection and use of personal data and unlawful processing of sensitive data
  2. 165,455 further accounts (delivery lists: name, phone, address)
  3. Corrected notice after the PIPC's emergency resolution of December 3, 2025: '유출' instead of '노출', building entrance codes added. People on delivery lists who are not Coupang members were not notified (PIPC June 2026)
  4. First notice used '노출', listed name, email, delivery address book and some order info, and was posted for one to two days

Sources