Coupang data breach traced to ex-employee who retained system access

Coupang, South Korea’s largest online retailer with about 95,000 employees and over $30 billion in annual revenue, confirmed a June 24 data breach that exposed personal data on 33.7 million customers and was discovered on Nov. 18 and publicly disclosed Dec. 1; the company says the stolen data has not been leaked online and is cooperating with authorities. Seoul police, after raiding Coupang offices to collect logs and access records, have tied the incident to a 43‑year‑old former employee who retained access after leaving in 2024 and is believed to have left the country; CEO Park Dae‑Jun resigned amid the probe and authorities warned Coupang could face liability if negligence is found. The episode—described as the country’s worst cybersecurity breach—has prompted a wave of phishing scams affecting an estimated two‑thirds of the population, raising substantial reputational, regulatory and operational risks for Coupang and wider industry cybersecurity oversight.

Analysis

Coupang confirmed a large-scale data breach that exposed personally identifiable information for 33.7 million customers; the intrusion occurred on June 24, 2025, was discovered November 18 and publicly disclosed December 1, and the company said on December 6 that the stolen data had not surfaced online. Seoul police raided Coupang offices, tied the incident to a 43-year-old former employee who had retained access after leaving in 2024 and who was assigned to an authentication management system, and are collecting logs, IP records and credentials as part of an independent probe. CEO Park Dae-Jun resigned amid what authorities and media describe as South Korea’s worst cybersecurity breach, and police cautioned that Coupang could be liable if investigations find negligence or legal violations. The breach has already generated a wave of phishing and impersonation reports affecting roughly two-thirds of the population, creating immediate reputational, regulatory and operational downside risk for Coupang and raising near-term volatility for the stock (CPNG).

Key Decisions for Investors

• Reduce directional exposure to CPNG or trim position size until police findings clarify whether negligence or systemic controls failures will trigger regulatory fines or litigation
• Implement hedges such as protective puts or collar strategies to limit downside from further negative disclosures, customer attrition or guidance cuts
• Monitor three near-term binary catalysts closely—evidence of leaked data, formal regulatory enforcement actions, and disclosure of remediation/audit results—and reassess positioning after each
• If maintaining a long position, require clear, verifiable remediation steps (independent security audit, IAM overhaul, customer remediation plan) and management replacement details before adding risk
• Watch operational metrics (order volume, customer churn, refund/compensation announcements) and phishing-related user complaints as leading indicators of revenue and reputational impact