Coupang's 2025 breach: 34M accounts exposed by a former employee's data key

In December 2025, South Korea's largest e-commerce company Coupang disclosed that a former employee had stolen an internal data key and accessed the personal information of 33.7 million customer accounts — nearly the entire adult population of the country. The breach had been ongoing since June 2025 before it was detected, and between 2,600 and 3,000 accounts had their data actually extracted.

The response was swift and severe. Korea's Personal Information Protection Commission fined Coupang a record 560 billion won (~$409 million), the largest data-protection penalty in the country's history. The government launched a coordinated whole-of-government investigation including police raids on the company's Seoul headquarters, a special tax audit, and parliamentary summons for executives. Coupang committed 1.69 trillion won (~$1.18 billion) to a customer compensation fund.

CEO Park Dae-jun resigned in December 2025. The case became a national scandal because Coupang held data on nearly every Korean adult — its dominance in e-commerce had turned the company into a single point of failure for national personal data security. The breach also created diplomatic friction when U.S. officials warned against what they saw as punitive treatment of an American-listed Korean company.