Coupang Confirms Data Leak Impacting 33 Million Customers

A significant data breach at Coupang has affected approximately 33 million customers in South Korea, according to a statement from Bae Kyung-hoon, the country’s Science Minister. During a parliamentary session on December 30, 2023, he expressed serious concerns regarding a report from the US-listed e-commerce giant that downplayed the scale of the incident.

The joint investigation by government and private sector entities, including the Personal Information Protection Commission and the police, revealed that personal details such as names and email addresses of millions were compromised. Bae emphasized that the government does not accept Coupang’s claim that only data from roughly 3,000 accounts was downloaded and subsequently deleted by the suspect. Instead, he mentioned that further sensitive information, including user addresses and order history, may also have been leaked.

Coupang has announced a compensation plan valued at more than 1.68 trillion won (approximately $1.17 billion) in response to the breach. This decision follows an apology from Coupang founder Kim Bom-suk, marking his first public comment since the incident, which has affected nearly two-thirds of South Korea’s population.

Under the compensation plan, the company will distribute 50,000 won worth of discounts and coupons to each of the 33.7 million customers impacted. This includes active members of Coupang Wow, regular users, and even former customers who have since closed their accounts. Payments are set to commence on January 15, 2024.

In detail, the compensation will be structured as follows: 5,000 won for purchases on Coupang’s e-commerce platform, 5,000 won for food delivery service Coupang Eats, 20,000 won for travel products, and another 20,000 won for luxury beauty and fashion items offered under the R.LUX brand.

Coupang claims to have identified the former employee responsible for the breach through forensic analysis, and they have recovered the equipment used in the incident. Despite this, the government has criticized Coupang’s findings as a “unilateral claim,” indicating that the comprehensive investigation into the matter has yet to reach any definitive conclusions.

Bae’s remarks reflect a broader concern over the handling of personal data in South Korea and the responsibility of companies to protect customer information. He stated, “We express grave concern toward Coupang, which issued an announcement that had not been coordinated with the government.”

The ongoing fallout from this breach not only raises questions about data security but also highlights the responsibilities of major corporations in protecting the personal information of millions. As Coupang navigates this crisis, interim Chief Executive Officer Harold Rogers affirmed the company’s commitment to transforming into a more customer-centric organization, stating, “Taking this incident as a turning point, Coupang will wholeheartedly embrace customer-centric principles and fulfill its responsibilities to the very end.”