iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Coupang disclosed on November 29, 2025, that personal information associated with approximately 33.7 million customer accounts in Korea had been exposed. That figure describes the company’s disclosure—not proof that every record was retained or shared. Later government and privacy-regulator findings use different counts and include additional groups of people.
What happened?
Coupang said unauthorized access to customer data was believed to have begun on June 24, 2025. The company said it discovered the incident on November 18, initially identifying about 4,500 affected accounts. On November 29, it revised its estimate to approximately 33.7 million accounts in Korea.
The figures changed as investigators examined different records and populations. The government joint probe reported exposure involving over 33.6 million accounts, while the Personal Information Protection Commission (PIPC) later described Coupang users and third-party data subjects separately.
| Account | Reported scope | What the figure counts |
|---|---|---|
| Coupang disclosure, November 29, 2025 | Approximately 33.7 million | Korean customer accounts the company said were affected. |
| Government joint probe, reported by Yonhap on February 10, 2026 | Over 33.6 million accounts; 33.67 million users in one finding | The probe confirmed exposure involving over 33.6 million accounts and reported that names and email addresses of 33.67 million users were leaked from the system. |
| PIPC findings, June 2026 | About 33.22 million Coupang users, plus about 4.33 million third-party data subjects | The PIPC identified these as separate groups. Do not treat their combined total as the same measure as Coupang’s customer-account count. |
What information was exposed?
In its November 29 notice, Coupang listed names, email addresses, phone numbers, shipping addresses and certain order histories. The company said payment information, credit-card numbers and login credentials were not exposed.
#1 Best Overall
Later findings described additional information and people. Yonhap’s account of the government probe said investigators found shared building-entrance passwords among the exposed information. The PIPC said shipping information for third-party data subjects was involved, including names, telephone numbers, addresses, order information and building-access passwords. These findings broaden the picture beyond the categories in Coupang’s initial customer notice.
The government probe reported that delivery pages were viewed about 148 million times. That is a page-view count, not a count of distinct people or confirmed downloads. Investigators said they analyzed 25.6 terabytes of web access logs.
Was my password or payment information stolen?
Coupang’s November 29, 2025 notice said passwords and payment details were not exposed and told customers that no account action was required at that time. That is the company’s stated assessment and advice on that date; it should not be read as proof that every possible type of misuse was ruled out. The later findings summarized here do not establish that payment credentials or passwords were exposed.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The cited notice did not require a password reset. If you choose to change your password as a precaution, use Coupang’s official app or website rather than a link in a message about the breach. Use a unique password, especially if you reused the old one elsewhere.
How did the access happen?
The government joint probe, as reported by Yonhap on February 10, 2026, attributed access to forged digital passes that exploited a vulnerability in an authentication system. The probe also found missing logs. The PIPC’s June findings described inadequately protected authentication-signing keys, insufficient access controls and inadequate response to anomalous activity. The commission’s official English release is an unofficial translation of its Korean press release.
The PIPC characterized the incident as resulting from inadequate baseline safeguards and security management rather than sophisticated hacking. Choi Woo-hyuk, director general of the Ministry of Science and ICT’s cybersecurity bureau, similarly described it as a management issue, not a sophisticated attack.
Was the data sold, shared or retained?
Coupang said its investigation found that a former employee accessed data from more than 33 million accounts but retained information from about 3,000 accounts, later deleted it and did not transfer it to anyone else. In its February 2026 response, the company said forensic evidence supported that account and that it had found no dark-web activity or secondary harm.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsThose are company claims, not a replacement for the government’s finding that millions of accounts were exposed. Yonhap reported that the joint probe found no evidence at that point that leaked data was circulating on dark-web platforms. That finding describes what investigators found then; it does not establish that no data was ever copied or that no later misuse occurred.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What should Coupang customers do?
- Be alert to impersonation. Coupang’s November 2025 notice specifically warned customers about calls, texts and other communications pretending to be from the company.
- Do not follow unexpected links or share verification codes. If a message asks you to confirm account details, payment information or a delivery password, check through Coupang’s official app or website instead.
- Review unusual account activity. Contact Coupang through an official channel if you see activity you do not recognize.
- Take shared building-access information seriously. If you believe a building-entry password was exposed, ask your building manager or delivery service how to change it safely.
- If you are not a Coupang member, do not assume the incident cannot affect you. The PIPC identified third-party data subjects whose shipping information was exposed and said affected non-members also needed notification. The findings summarized here do not establish that every such person has received direct notice.
What penalties and compensation were announced?
In June 2026, the PIPC resolved a 423.575 billion won penalty related to Coupang’s safeguard failures in this breach. It also imposed a separate 16.8 million won fine concerning notification and destruction duties. The PIPC’s Korean notice summarized a total 624.681 billion won penalty across multiple findings, including matters such as unlawful online behavioral-data collection; that larger total is not solely a breach penalty. The commission also announced a separate penalty for Coupang Fulfillment Services, for which the cited release does not state an amount here.
Coupang said it intended to seek legal review, and its SEC-filed notice said the PIPC findings and penalties were subject to judicial review. The materials summarized here do not establish a later court outcome.
Coupang also announced approximately 1.685 trillion won in purchase vouchers for the 33.7 million accounts it said it had notified at the end of November 2025, with distribution beginning January 15, 2026. The announcement describes planned purchase vouchers, not a cash payment, and does not establish how many were ultimately used.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
