By Jiyoung Sohn and Timothy W. Martin
SEOUL -- The alleged perpetrator had improper access to virtually every South Korean adult's personal information: names, phone numbers and even the keycode to enter residential buildings.
It was one of the biggest data breaches of recent years and it has sent the company it targeted -- Coupang, South Korea's equivalent of Amazon -- reeling, generating lawsuits, government investigation and calls to toughen penalties against such leaks.
The leak went undetected for nearly five months, hitting Coupang's radar on Nov. 18 only after a customer flagged suspicious activity.
At first, Coupang, which was founded by a Korean-American entrepreneur, said it had experienced a data "exposure" affecting roughly 4,500 customer accounts. But within days, the e-commerce firm revised the figure: The leak exposed up to roughly 34 million user accounts in South Korea -- a sum representing more than 90% of the country's working-age population. Coupang started calling the incident a "leak" after Korean regulators took issue with the company's prior word choice.
"The Whole Nation Is a Victim," read one local news headline.
An investigation has found that the alleged perpetrator had once worked in South Korea as a software developer for authentication systems at Coupang, which is known for its blockbuster U.S. initial public offering a few years ago. The suspected leaker is believed to be a Chinese national who has moved back to China and is now on the lam, South Korean officials say. They haven't named the person.
Even after leaving the firm roughly a year ago, the suspect secretly held on to an internal authentication key that granted him unfettered access to the personal information of Coupang users, South Korean authorities and lawmakers say. The infiltration, using overseas servers, started on June 24. By using the login credentials, the suspect was able to appear as if he were still a Coupang employee when accessing the company's systems.
The alleged perpetrator didn't access other sensitive areas, such as credit-card numbers or government-issued identification numbers, according to Coupang.
The saga at Coupang led to the resignation last week of the CEO overseeing operations in South Korea, where the company generates the overwhelming bulk of its revenue. Multiple government investigations remain ongoing. Investigators haven't publicly disclosed the suspect's whereabouts or motives.
Coupang has offered an apology and vowed to work with investigators. "We will significantly enhance our information security to prevent recurrences and will do everything we can do to recover trust," it said.
On Wednesday, the interim CEO of Coupang's South Korea operations, who had previously served as the general counsel of the parent company, is expected to attend his first legislative hearing in his new role.
Lee Kyo-re, 25, is one of millions of Koreans who have left Coupang. With her personal information leaked, Lee said she has received several unwelcome calls a day from firms trying to sell her insurance, credit cards and red ginseng. She feels like Coupang hasn't shown remorse.
"I lost trust after the incident," Lee said.
Local police raided Coupang's Seoul office last week in hopes of unearthing more details about the leak's origins. South Korean President Lee Jae Myung said Friday that penalties for personal-data breaches need to go further because they don't deter violations enough.
"If things go wrong, the companies could go bankrupt. We must make them think like this," Lee told officials working at the country's personal data-safety commission.
Coupang was founded in 2010 as a daily-deals business like Groupon by the Harvard-educated Bom Kim, a Korean-American. The company pivoted into e-commerce, won major backing from SoftBank Group and in 2021 enjoyed one of the biggest foreign-company debuts on the New York Stock Exchange in years.
The firm is now based in Seattle and incorporated in Delaware. Coupang has sought to expand outside South Korea to Taiwan, Japan and elsewhere. Kim, who routinely appears on the parent company's earnings calls, won't attend this week's legislative session despite lawmaker demands to appear. Kim, in a letter to legislators, cited official business commitments as the reason.
Coupang's "WOW" membership costs about $5.50 a month in South Korea, and includes access to overnight grocery deliveries, as well as a streaming platform and food-delivery service.
Under South Korea's personal-information protection laws, Coupang could face a fine of up to 3% of the average annual revenue generated during the prior three years. That would equate to roughly $750 million, a record for the country. Separately, Korea's Fair Trade Commission is looking into whether Coupang made its account-deletion process difficult after customers raised complaints last month once the leak became public.
Some Coupang users like Jang Ji-hee, 34, find it difficult to make a break with Coupang despite disappointment over the data leak. At home with a 1-year-old child, she said that finding time to go out shopping is difficult and that she buys nearly everything on Coupang.
"It's just too convenient, and there aren't better alternatives," Jang said.
Write to Jiyoung Sohn at jiyoung.sohn@wsj.com and Timothy W. Martin at Timothy.Martin@wsj.com
(END) Dow Jones Newswires
December 16, 2025 05:30 ET (10:30 GMT)
Copyright (c) 2025 Dow Jones & Company, Inc.
Comments