Data Breach by Former Employee Rocks Korean E-Commerce Giant

134.8 billion won (approximately $115 million USD)South Korean e-commerce giant Coupang suffered a massive personal data leak that began in June 2025  and was discovered in November. The names, addresses, and phone numbers of 33.7 million customers were stolen, thoughthe company emphasized that user credit card information was unaffected. 

The Korea Times reported thatSouth Korean President Lee Jae-myung criticized the company for being unaware of the breach, and at a state council meetingcalled for regulatory bodies to impose stricter penalties on the company. Lee also mentioned implementing stricter penalties and a punitive damages system to prevent a similar recurrence.

After the leak was revealed, internal investigations at Coupang found the perpetrator was a former Chinese employee on the company's verification system development team. The individual has since left both the company and South Korea.

The individual used Coupang's electronic signature key to access the backend servers where users' personal data was stored. Questions about why the employee still had such access after leaving the company have led to doubts about misconduct. South Korean police have identified the IP addresses used and are diligently tracking down those behind the incident.

This is South Korea's largest data leak to date and could lead Coupang, a rapidly rising e-commerce giant dominating the country's domestic market, to face a record-breaking fine of up to 1 trillion won ($770 million USD). The estimated fine amount is based on calculations under relevant legislation, which allows companies to be fined up to 3% of revenue related to leaked data. Coupang's domestic revenue for the first three quarters of 2025 is estimated at 31.226 trillion won ($26.7 billion USD).

The previous largest such fine was ​134.8 billion won ($115 million USD) imposed for a data leak at SK Telecom that affected over 23 million people. 

​South Korean academics and civil organizations have warned that if the government does not impose strict financial penalties on companies for major data leaks, there is little hope that the country's major conglomerates will proactively improve data security.