Coupang

HighConfirmedRetailOctober 8, 2026

Coupang, South Korea's largest online retailer, acknowledged unauthorized access to the personal data of 33.7 million customers. Access began on 24 June 2025 and was only detected on 18 November, starting from customer accounts. The data involved includes names, email addresses, phone numbers, delivery addresses and part of the order history. According to the police, the main suspect is a former employee who allegedly used access to an authentication management system after leaving in 2024; the company states that login credentials and payment card data were not reached. As of October 2026, press reports say Coupang is challenging in court the 624.6 billion won fine imposed by the data protection authority (PIPC), which itself cites about 37.55 million people affected.

These contact details and order histories let a malicious third party build credible phishing or fraudulent solicitation attempts that cite the person's identity, address or recent purchases.

Disclosed on: October 8, 2026
Incident dated: June 24, 2025
Accounts affected: 34M
Sector: Retail
Country: South Korea
Cause: Direct intrusion

Exposed data

Full name
Email address
Phone number
Postal address
Order history

You are only affected if you had an account or an order with this organisation.

What you can do

Expect phishing attempts quoting your name and this company. A message that knows your details is not legitimate for that reason.
You can ask the organisation exactly what was exposed about you (right of access), and complain to the DPA if no answer comes within a month.

Sources

Entry built from the cited sources after a corroboration check, then reviewed before publication. Spotted an error, or have a correction? Write to us and the entry will be fixed. Contact

Exposed data

What you can do

Sources

The tech and security week, every Monday in your inbox