You may have been affected by Coupang's data breach. Here’s what you should do
On Saturday, e-commerce giant Coupang confirmed a data breach that potentially impacted 33.7 million customer accounts. Although the data breach is believed to have begun as early as June through servers overseas, Coupang failed to detect the cyber intrusion for five months. What caused the data breach? A former employee, A Chinese national who quit in December 2024, is suspected of being behind the breach. Appearing at a parliamentary session on Tuesday, Coupang CEO Park Dae-jun said the suspect had worked as a developer on the company’s authentication and system access management team. The attacker is believed to have extracted customer information after leaving the company, by exploiting authentication tokens and a signing key. An authentication token acts like a temporary access pass issued after a user logs in, and a signing key is used to create and verify those tokens. Coupang failed to revoke or rotate the signing key even after the employee’s departure, exposing a serious gap in the company’s cybersecurity controls. “The suspect could be an individual or multiple people
