Coupang Data Breach: Government Disputes 33M Account Claims

Seoul, South Korea - The Ministry of Science and ICT issued a formal protest on December 25 after e-commerce company Coupang announced investigation findings regarding a data breach affecting 33 million customer accounts, with government agencies stating the claims had not undergone official verification.

The ministry stated it strongly protested to Coupang for publicly disclosing matters currently under investigation by the government-led joint investigation team.

The ministry noted that the announcement was confusing citizens. 

It emphasized that the type and scale of the leaked information, as well as the circumstances of the breach, remain under active investigation.

Coupang had announced on December 25 that a former employee accessed information from 33 million customer accounts using a stolen internal security key.

The company claimed data from approximately 3,000 accounts was stored on personal devices and subsequently deleted, including 2,609 building entrance codes.

Coupang stated that no payment data, login credentials, or individual customs clearance numbers were accessed.

Following criticism of conducting an independent investigation, Coupang released a detailed timeline on December 26, asserting that its activities were carried out under government direction.

According to this timeline, on December 9, the government suggested that Coupang contact the former employee directly.

The company stated that it met the individual on December 14, recovered the devices on December 16-18, and submitted the materials to the police on December 21 after obtaining government authorization.

Law enforcement agencies contradicted Coupang’s characterization.

Police stated there had been no consultation with Coupang and that authorities were verifying facts about the company’s investigation process.

The National Intelligence Service stated it was not in a position to give instructions regarding the incident and had not done so.

Coupang stated it recovered a MacBook Air from a river on December 18, after the former employee allegedly disposed of it in a canvas bag weighted with bricks.

The company stated it used a forensics team to document the device before providing it to authorities.

The government convened an inter-ministerial meeting on December 25, attended by the Deputy Prime Minister and Minister of Science and ICT, and officials from the Fair Trade Commission, the Personal Information Protection Commission, the Korea Communications Commission, the Financial Services Commission, and the Presidential Office.

Authorities announced plans to expand a cross-ministerial task force and to develop institutional reforms to address information security at platform companies.

Coupang stated it engaged Mandiant, Palo Alto Networks, and Ernst & Young for forensic investigations.

The company maintained its findings aligned with the former employee’s sworn statements and that the individual worked alone with no data transmitted to third parties.

The ministry’s December 25 statement emphasized that Coupang’s claims remain unconfirmed by the official investigation team.

The ministry stated results would be transparently disclosed once verified through proper investigative procedures.

Coupang stated that it complied with government instructions to maintain confidentiality during the investigation, even as it faced criticism from government agencies, the National Assembly, and media outlets.

The company stated it would announce customer compensation measures and cooperate with ongoing government investigations.