South Korean e-commerce leader Coupang has been hit with a record 624.681 billion won fine (roughly $409 million) after the country's Personal Information Protection Commission (PIPC) confirmed a data breach that exposed the personal information of 37.5 million people. Announced by the PIPC on June 10, 2026, it is the largest privacy penalty ever imposed by the South Korean government. Investigators traced the intrusion to a former employee who had personally built an alternative authentication system while working at the company, then used retained signing keys to harvest customer and non-customer records at scale.
What Happened
According to the PIPC, the breach was carried out by a former Coupang employee who had developed an alternative authentication system during their tenure. After leaving the company, that individual leveraged still-valid signing keys to access Coupang service pages and extract personal data. The commission found that fundamental safety controls failed: authentication signing-key management and access controls did not function as intended.
Coupang's token-based authentication system granted access based solely on electronic signature verification. That design created a single point of catastrophic failure: anyone holding the keys used to sign tokens could impersonate and access any member account. Critically, even after the employee who held those keys departed, Coupang did not immediately rotate or revoke them, leaving the door open long after the insider's authorized access should have ended.
The PIPC imposed the 624.681 billion won fine alongside an additional 16.8 million won penalty, and approved corrective measures to prevent recurrence. Those measures include strengthening security controls, notifying affected non-member data subjects, and ensuring a substantive operational role for the Chief Privacy Officer. The commission plans to inspect Coupang's compliance within three months.
What Was Taken
The intrusion exposed records belonging to a total of 37.5 million people. Specifically, the attacker extracted the personal information, including names and emails, of 33,222,472 members, plus the personal information of 4,338,368 non-members.
The most sensitive exposure involved delivery address data. The leaked records contained not only members' own details but also the names, phone numbers, and addresses of third parties such as family members and friends tied to delivery destinations. Shared front-door entrance passcodes were also leaked, turning a digital breach into a tangible physical-security risk for households that never consented to or even knew about the data being held.
Why It Matters
This incident is a defining case for several reasons. The fine itself sets a new ceiling for privacy enforcement in South Korea, signaling that regulators will pursue penalties proportional to the scale and avoidable nature of a breach. For multinational platforms operating in the region, the message is that lax key lifecycle management is now a board-level financial risk.
It also underscores the danger of insider-originated, persistence-based attacks. The most damaging breaches are not always sophisticated external campaigns; here, a single departed employee armed with legitimate cryptographic material was enough to compromise tens of millions of accounts. The leakage of front-door passcodes and third-party contact details further blurs the line between data privacy and physical safety, raising the stakes for any service that stores delivery and access information.
The Attack Technique
The root cause was a combination of design weakness and operational failure. Coupang relied on electronic signature verification as the sole basis for token-based authentication. Because any valid signature was trusted, possession of the signing keys was functionally equivalent to possessing every member's credentials.
The departed employee retained those keys. Coupang's failure to rotate or discard signing keys upon offboarding meant the insider's privileged access never truly expired. Using that material, the actor authenticated against service pages and systematically extracted member and non-member records. Compounding the problem, Coupang's monitoring did not catch the abuse: numerous abnormal connections occurred throughout the attack window, but the irregular activity went undetected until customers who had received the data began surfacing concerns. The breach therefore reflects a full breakdown across three control layers: identity design, key lifecycle management, and anomaly detection.
What Organizations Should Do
- Rotate and revoke all cryptographic keys, tokens, and certificates as part of every employee offboarding, and treat signing keys held by departing staff as compromised by default.
- Eliminate single-factor signature trust. Do not allow a valid electronic signature alone to authorize access to all accounts; layer in scoped permissions, short-lived tokens, and additional verification for sensitive operations.
- Inventory and tightly control signing-key custody, enforcing least privilege, hardware-backed key storage, and audited access so no individual can unilaterally hold platform-wide authentication power.
- Deploy anomaly detection that alerts on abnormal connection volumes, unusual access patterns, and bulk data extraction, with response thresholds that trigger before customers notice rather than after.
- Minimize and segment stored personal data, especially third-party delivery details and physical access codes, so a single token compromise cannot expose adjacent and non-consenting parties.
- Empower the Chief Privacy Officer with real operational authority and conduct regular access-control and key-management audits to verify that basic safety systems are actually functioning.
TWEET: Coupang breached by ex-employee using retained signing keys. 37.5M people exposed; record $409M fine. Full breakdown: https://wasteland.me/intel/coupang-data-breach-fine #CyberSecurity #ThreatIntel