Coupang confirms massive data breach exposing 33.7 million accounts

South Korean e-commerce giant Coupang, dubbed the Amazon of South Korea, suffered an unprecedented breach affecting almost 34 million customer accounts.

Coupang, which is the country’s top online retailer, said that due to unauthorized data access, millions of accounts were exposed, all in Korea.

The company became aware of the breach on November 18th and says it reported the case immediately to the Personal Information Protection Commission, the police, and the Korea Internet and Security Agency.

Coupang believes that unauthorized access started on June 24th through overseas servers and grew to an unprecedented scale. According to Reuters, Coupang’s product commerce active customers reached 24.7 million in the third quarter.

The company initially estimated that the breach affected around 4,500 individuals, but later updated the figure to over 33 million.

Crooks managed to access a trove of personal data, including name, email address, phone number, shipping address, and certain order histories. However, payment details or login credentials were not compromised, according to the firm.

According to Yonhap News Agency, a Chinese former employee at Coupang is suspected to have orchestrated the breach, but the investigation is ongoing.

“We sincerely apologise once again for causing our customers inconvenience,” CEO Park Dae-jun posted on the company’s website.

The government held an emergency meeting on Sunday, investigating whether Coupang violated safety rules in regard to personal information protection, said Minister of Science and ICT Bae Kyung-hoon.

The Korea Internet & Security Agency (KISA) issued an advisory to affected individuals explaining how to stay safe in case of potential phishing scams.

Coupang is bracing for the fallout from the breach, with some customers reportedly preparing a class-action lawsuit.