A view of Coupang’s headquarters in Songpa District, Seoul. (Yonhap)
SEOUL, Dec. 1 (Korea Bizwire) — Days after Coupang disclosed a data breach affecting some 33.7 million customer accounts, users say they remain in the dark about what personal information was compromised, fueling anger and confusion surrounding one of South Korea’s largest-ever privacy failures.
Coupang announced on Nov. 29 that names, email addresses, phone numbers, physical addresses and portions of order histories had been leaked. But many customers fear that more sensitive information — including apartment-entry codes or personal customs clearance numbers used for overseas purchases — may also have been exposed.
The company, after initially remaining silent, said Friday that customs clearance numbers had not been leaked. Still, Coupang has yet to specify which data fields were breached on an individual basis.
“As of now, confirming who was affected, what was exposed and the scope of the damage is our top priority,” CEO Park Dae-joon told reporters.
The breach reportedly began in June, but Coupang failed to detect it for nearly five months, dramatically widening the scale of exposure. Authorities believe the leak was not the result of an outside cyberattack but the work of a former employee — a foreign national who has since left both the company and the country. Investigators fear this could complicate the probe.
Coupang’s data breach undetected for five months, triggering customer alarm (Yonhap)
Coupang is also under fire for what critics call a sluggish and disorganized response. Some customers received notification messages days later than others, and an official apology from the company’s leadership did not arrive until nearly 24 hours after the announcement.
This is not Coupang’s first data protection scandal. Since 2020, the company has been fined multiple times by the Personal Information Protection Commission for leaking delivery worker information and other personal data.
Public backlash is building rapidly. Civil society group People’s Solidarity for Participatory Democracy condemned the company, asking whether an American firm would have managed U.S. customer data so loosely. It demanded full disclosure of the breach and credible compensation plans.
The photo shows the personal information exposure notification text message that Coupang sent to affected customers on November 30. (Yonhap)
Consumer groups are preparing collective action. As of 2 p.m. Friday, more than 245,000 people had joined at least 10 online communities organizing a class-action lawsuit against Coupang. A separate KakaoTalk chatroom is coordinating additional legal efforts.
On Friday, 14 Coupang users filed the first damages suit with the Seoul Central District Court, seeking 200,000 won per person in compensation.
Consumer organizations have also threatened boycotts if Coupang’s response does not improve. The Korea Consumer Organizations Council warned that it would mobilize “all available means,” including membership cancellations and coordinated boycotts.
Online forums are already filling with posts from users saying they have deleted their Coupang accounts. Customers can withdraw membership via the “My Information” settings on the app or website, while paid subscribers may cancel their Wow membership separately.
Ashley Song (ashley@koreabizwire.com)
