Major Data Breach at Coupang: South Korean Authorities Investigate

In a significant online security breach, South Korea is grappling with the fallout of a vast data leak at Coupang, the nation’s leading e-commerce platform. Following the incident, police and government representatives are urgently working to uncover how the sensitive information of over 33 million users was compromised.

Reports indicate that the breach may have initiated on June 24, utilizing servers outside of South Korea. Coupang, however, remained unaware of the issue until November 18, raising serious concerns regarding the company’s surveillance and data protection measures during this extensive period.

Science Minister Bae Kyung-hoon stated that vulnerabilities in Coupang’s authentication processes were exploited by the attackers. This raises questions on whether the company adhered to national standards for protecting personal data and if significant consequences should follow.

The compromised data reportedly contains names, email addresses, phone numbers, shipping details, and selections from customer order histories, although Coupang asserts that financial details and passwords remain secure. Despite this, the potential for identity theft and severe privacy issues has incited outrage among millions in South Korea.

Reports have emerged about a former Chinese employee of Coupang possibly being linked to the breach. This individual was previously involved in tasks related to authentication and allegedly maintained access rights after their employment ended. Lawmaker Choi Min-hee claims that this access enabled the former staff member to retrieve customer information indefinitely. Both the police and Coupang have refrained from commenting on this allegation.

Public outcry is escalating quickly. By Monday afternoon, a significant online movement had garnered support from over 10,000 people intending to file a class action lawsuit against Coupang, with lawyer Ha Hee-bong estimating that each impacted individual could seek upwards of 100,000 won (approximately $68) in damages. The financial repercussions for Coupang could be extensive if this legal push gains momentum.

Founded in 2010 by Bom Kim, a Korean-American entrepreneur, Coupang has swiftly established itself as a leader in South Korea’s online retail landscape, receiving backing from Japan’s SoftBank and branching into food delivery, video streaming, and financial services. Yet, this incident has significantly undermined public confidence in the brand, which has prided itself on its reliability.

Officials argue that the breach reveals systemic vulnerabilities within South Korea’s data protection infrastructure. Presidential Chief of Staff Kang Hoon-sik highlighted four major data leaks since 2021, including a recent cyberattack on SK Telecom that compromised data of nearly 27 million users, resulting in a fine of approximately 134 billion won. He emphasized the need for fortifying laws and penalties related to data breaches.

Kang urged that the Coupang incident should serve as a pivotal moment. The government must enhance regulations and intensify penalties for negligence, reinforcing the need for companies to regard personal data with utmost seriousness. Millions are now calling for immediate action, robust protections, and accountability.

The Coupang data leak is far from merely a technical issue; rather, it serves as a critical reminder of the necessity for stringent protection of personal information in a society where digital interactions are increasingly prevalent. South Koreans will watch closely as the situation unfolds, seeking assurance that preventive measures will be taken to avert similar occurrences in the future.