PRIVACY DETECTIVE · COUPANG
Coupang personal data breach (2025)
The regulator found that names, emails and other data of about 37.55 million people — 33.2 million members and at least 4.34 million non-members — leaked between April and November 2025. The same decision separately sanctioned unauthorised collection of activity on other sites and apps (about 11.17 million users).
Checked 2026-10-03
- Affected
- 37,560,840 people (33,222,472 members + at least 4,338,368 non-members)
- Data taken
- Name · Email · Phone · Address · Transaction history · Other
- Confirmed money loss
- None confirmed
- Entry vector
- Insider
- Attack → detection
- Not published
- Fines
- ₩624.7bn
- Proceeds recovered
- Not published
05 STEPS
Breach → taken → resold → money → who paid
- 1. HOW IT HAPPENED
How it happened — Mass access to customer records using a security key (Apr–Nov 2025)
- 2. WHO GOT THE DATA
Who got the data — The company says a former employee acted alone — investigation not concluded
- 3. HOW IT WAS RESOLD
Was it resold — Not established by official sources
- 4. HOW IT BECAME MONEY
How it became money — Not established by official sources
- 5. WHO PAID THE LOSS
Who paid the loss — The company pays the fine; no consumer money loss confirmed. Impersonation contacts reported
TIMELINE
Time to detect, report and notify
- Attack start → detection
- 2025-04 → — · Not published
- Detection → report
- Not published
- Detection → customer notice
- Not published
Regulator: leak period April–November 2025
DATA
What was taken, and what it enables
- Identity data
- Name · Email · Phone · Address · Transaction history · Other
What this combination can be used for
- Identity data only → Spam, impersonation calls, targeted phishing (e.g. luring you into a reset)
Company statement: a former employee used a security key obtained while employed; for some accounts building-entrance codes were also saved. Police are investigating. News (citing officials) 2026-06
CRIME-AS-A-SERVICE
Roles confirmed in this case
○ Victim data stolen → ○ Brokered and resold → ○ Buyer takes over accounts → ○ Fraud or unauthorised payment → ○ Mule account → ○ Laundering → ○ Cash-out
● step confirmed in this case · ○ not established (which does not mean it did not happen)
GEOGRAPHY
Location facts, kept apart
| Field | Value | Basis |
|---|
| Victim country | South Korea Per regulator decision | Confirmed by law enforcement News (citing officials) 2026-06 |
| Suspect nationality | Not officially announced | Unknown |
Login-IP countries can differ from an attacker’s nationality or base because of VPNs, proxies and hijacked devices. Nationality appears only for individuals named by investigators and is never generalised to a country.
LOSS & PROCEEDS
Victim loss and criminal proceeds
- Victim money loss
- No amount established
RESPONSE & ENFORCEMENT
Company response and enforcement
- Company statement · 2025-12-25
- "A former employee acted alone, saved data on about 3,000 accounts and deleted it; nothing sent to third parties" News (citing officials) 2025-12
- Fine · PIPC · 2026-06-10 · Contested
- ₩423.6bn Breach — security failures (about 37.55m people). The company announced legal action News (citing officials) 2026-06
- Fine · PIPC · 2026-06-10 · Contested
- ₩201.1bn Separate breach of law — unauthorised collection of activity on other sites/apps (about 11.17m users) News (citing officials) 2026-06
- Security spend before vs costs after
- Not public — security budgets and legal costs are not estimated
CLAIM VS FINDING
Where statements and findings differ
DETECTIVE RADAR
Coupang personal data breach (2025) from other angles
△Origin DetectiveApplies · not analysed yet
△Distribution DetectiveApplies · not analysed yet
△Tax DetectiveApplies · not analysed yet
△Wage DetectiveApplies · not analysed yet
✓Privacy DetectiveThis page
△Regulation DetectiveApplies · not analysed yet
✓ analysed · △ applies, not analysed yet · not applicable: Cost Detective, Inflation Detective, Discount Detective, Value Detective, Hype Detective, Hogu Index, Ingredient Detective (food & drinks) · All axes on one page