Skip to content
HACKTECH
BreachesReported Published 5 sources

Coupang breach of 33.7 million accounts traced to a former engineer's stolen signing key

South Korean e-commerce company Coupang first disclosed on 29 November 2025 that personal data of about 33.7 million users had been leaked. A joint public-private investigation, whose tentative results the Ministry of Science and ICT announced in February 2026, found that a former backend engineer used a stolen signing key to forge electronic access passes, beginning on 14 April 2025. Coupang said names, emails, addresses and phone numbers were accessed but not payment or log-in data. According to Coupang's 8-K, on 10 June 2026 the Personal Information Protection Commission announced a fine of approximately $278 million relating to the incident.

  • South Korea
  • retail
  • e-commerce
  • insider threat
  • key management
  • PIPC
  • regulatory fines

What the sources report

  • The Ministry of Science and ICT announced the tentative results of the joint public-private investigation on 10 February 2026; Biometric Update reported that 33.67 million users' names and email addresses were leaked and that the former engineer began exploiting vulnerabilities in Coupang's gateway server system on 14 April 2025.
  • Investigators found Coupang had inadequate systems and procedures for rotating signing keys when staff depart, that a currently employed developer was storing a signing key on a laptop, and that development and production environments were not segregated.
  • Investigators found automated web-crawling tools were deployed on 8 November 2025 and that 2,313 IP addresses were used.
  • Coupang reported the breach to Korean authorities on 19 November 2025; Biometric Update said this was two days after the company first became aware of it, and KEIA's timeline says the report exceeded the 24-hour reporting requirement under South Korea's information network law.
  • On 29 December 2025 Coupang announced a compensation plan worth 1.685 trillion won, equal to 50,000 won per customer in four single-use vouchers.
  • Coupang's 8-K, filed on 11 June 2026, said the PIPC announced an administrative fine of approximately $278 million relating to the November 2025 data incident and a separate fine of approximately $132 million, unrelated to it, over data collected for a third-party advertising programme; BleepingComputer, reporting the PIPC's total fine of 624.6 billion won (roughly $409 million), quoted the regulator as saying personal information of approximately 37.55 million people leaked.

What it means for your organisation

Investigators attributed the theft to lax management of Coupang's user authentication system, and the PIPC cited negligence in authentication signature key management and access control. A stolen key able to sign valid access passes remained usable after the engineer left, and access ran for months before it was noticed. Token-signing keys need the same lifecycle controls as production credentials: storage only in a key management system, rotation on staff departure and monitoring of how tokens are used. Against the cost of rotating a key when an engineer leaves, Coupang faces a PIPC fine of about $278 million for this incident and has announced 1.685 trillion won in customer vouchers.

What we check

  • Inventory token and session signing keys, confirm they live only in a KMS or HSM, and check for copies on developer laptops, repositories or CI systems.
  • Test whether gateways accept forged, replayed or over-scoped authentication tokens, including key ID, audience and expiry validation.
  • Review leaver procedures for privileged engineers so that keys, secrets and key-management access are revoked or rotated on departure.
  • Check segregation between development and production environments and who can reach production key material.
  • Verify detection of mass account access or crawling from many source IPs, log retention for forensics, and the ability to meet a 24-hour notification rule.

Sources

Services that cover these checks

  • Application security audit

    A white-box review of your application: source code, architecture, dependencies and build pipeline. Automated analysis finds the candidates; reviewers confirm each one by reading the code path, and only confirmed defects reach the report, each with a file and line reference.

    Duration: 5 to 15 working days, depending on codebase size

  • Web application testing

    Authenticated, role-aware testing of your application and its API surface, with an account for every role. We chain small findings into the access they lead to, such as a sequential invoice ID and a missing tenant check that together let one customer read another's invoices.

    Duration: 5 to 10 working days

  • Cloud configuration review

    An IAM-first review of AWS, Azure or GCP. We map what an attacker reaches after compromising one workload or one developer laptop, then rank those paths by the data at the end of each and write the Terraform or policy change that cuts it.

    Duration: 4 to 8 working days

  • Threat modelling

    Facilitated workshops that map how a system or feature could be attacked before it is built or shipped. We draw the data flows with your engineers, walk them with STRIDE, rank the threats by likelihood and impact, and turn the result into backlog items and test cases your team owns.

    Duration: 2 to 5 days per system, remote or on site

  • Incident response

    Hands-on help when an attacker is already inside: triage on the first call, containment that does not destroy evidence, forensic scoping of what was touched, and recovery that we verify before calling it complete. Outside a crisis we run retainers, tabletop exercises and compromise assessments, so your team has practised the first hour before it happens.

    Duration: Live incidents until recovery is verified; readiness work in days

Run these checks against your own systems

We pick the checks that apply to your systems. A 45-minute scoping call ends with a fixed quote and a proposed start date; the written scope follows by email.

Scope an engagementHow incident response works