South Korea's Cybersecurity Certifications Face Crisis After Coupang's Record 33.7M Breach

Coupang, South Korea's leading e-commerce platform, has confirmed a massive data breach affecting 33.7 million customer accounts-nearly its entire user base-marking one of the largest privacy incidents in the country's history according to reports. The breach, which authorities suspect began as early as June 24 and went undetected for five months, exposed sensitive information including names, email addresses, phone numbers, delivery addresses, and partial order histories. While Coupang emphasized that payment details, credit card numbers, and login credentials were not compromised, the scale of the leak has raised urgent concerns about cybersecurity practices and regulatory oversight in the digital economy according to CNBC.

The breach is believed to have originated from unauthorized access via overseas servers, with police identifying a former Chinese employee of Coupang as a suspect according to police investigations. The individual, who has since left the company and South Korea, is under investigation for extracting data over an extended period. This marks a stark departure from previous data leaks in the region, which were typically attributed to external hacking. Coupang's CEO, Park Dae-joon, publicly apologized for the incident, acknowledging lapses in internal controls and vowing to cooperate with authorities to mitigate further damage.

The government has launched an emergency investigation into whether Coupang violated safety protocols under South Korea's stringent personal information protection laws. The Ministry of Science and ICT, along with the Personal Information Protection Commission (PIPC), is scrutinizing the company's compliance. The breach surpasses SK Telecom's data leak in April 2025, which affected 23.2 million users and resulted in a record fine of 134.8 billion won (approximately $92 million). Analysts speculate that Coupang could face an even steeper penalty, given the larger number of affected accounts and the company's repeated breaches since 2020.

Coupang's repeated security failures have drawn sharp criticism, particularly as it holds the ISMS-P certification-a government-run security framework-since 2021. Despite this, the company has faced four data breaches and fines totaling 1.5 billion won ($1.02 million) in the past five years. The incident has intensified debates about the effectiveness of national cybersecurity certifications, with critics arguing that regulatory oversight must evolve to address sophisticated internal threats.

The breach also underscores growing vulnerabilities in South Korea's digital infrastructure. The Korea Internet & Security Agency has issued public advisories warning affected users about phishing scams and identity fraud. Coupang urged customers to remain vigilant against fraudulent communications and to monitor their accounts for unauthorized activity. Meanwhile, the incident has reignited discussions about corporate accountability, with lawmakers demanding stricter enforcement of data protection laws.

As investigations continue, the fallout extends beyond Coupang. The breach highlights broader challenges in safeguarding user data amid rapid digitalization, particularly as cyber threats become increasingly complex. For South Korea, a global leader in technology and e-commerce, the incident serves as a critical test of its ability to balance innovation with robust security frameworks.