The 2025 Coupang Data Breach: The 33 Million Leak

From “Rocket Delivery” to “Record Breach”: Coupang is currently facing its greatest existential test. After a 140 billion won fine for algorithm manipulation in 2024, a massive data breach in late 2025 has exposed the records of 33.7 million users. This isn’t just a corporate scandal—it’s a national security and trust crisis for 2/3 of South Korea’s population.

Coupang’s rise was built on a promise of “indispensable convenience.” However, 2024 and 2025 have seen that promise strained by two major incidents that have shifted the narrative from innovation to governance failure.

I. The Dual Crisis: Algorithms and Anatomy of a Breach 💥

1. The 2024 Algorithm Manipulation Scandal

In mid-2024, the Korea Fair Trade Commission (KFTC) issued a landmark 140 billion won fine ($102 million) against Coupang.

The Issue: Manipulating search rankings to prioritize its own Private Brand (PB) products.
Deceptive Practice: Using thousands of employees to write over 72,000 positive “fake” reviews to boost sales.

2. The 2025 “33.7 Million” Data Breach

The situation escalated in late 2025 when it was revealed that nearly two-thirds of South Korea’s population had their data compromised.

📌 Key Info! The Insider Threat
The breach was reportedly executed by a dismissed IT specialist who retained access via a long-valid authentication token. The leak went undetected for five months (June–November 2025), exposing names, addresses, and order histories of 33.7 million people.

II. The Fallout: Legal, Financial, and Social 📉

Impact Category	Recent Development (Dec 2025)
Leadership	CEO Resignation: CEO Park Dae-jun resigned in December taking responsibility for the security lapse.
Financials	Massive Fines: Potential penalties under the Personal Information Protection Act (PIPA) could exceed 1 trillion won ($770M).
Stock Market	NYSE Slump: CPNG stock dropped significantly (over 17% from its September high) as police raided Seoul headquarters.

⚠️ Watch Out! The Class Action Wave
As of December 2025, tens of thousands of users are joining the largest class-action lawsuit in Korean history, seeking damages for the exposure of private home addresses and sensitive purchase data.

III. Future Prospects: A Pivotal Turning Point ⏳

The incidents of 2024-2025 mark the end of Coupang’s “unregulated growth” era. Moving forward, the company’s future depends on three strategic pivots:

The Path Forward for Coupang 📝

1. Security Overhaul: Introduction of Passkey-based authentication (planned for early 2026) and “Zero Trust” internal governance to prevent future insider threats.

2. Global Diversification: Rapid expansion in Taiwan is no longer a luxury—it’s a necessity to offset regulatory costs and market saturation in Korea.

3. Transparency Mandate: Coupang must now operate under the shadow of the “Platform Law,” which will likely enforce stricter transparency on how search algorithms work and how data is handled.

Frequently Asked Questions ❓

Q: Is my payment information safe in the 2025 breach?

A: According to Coupang’s official statements, passwords and credit card information were NOT exposed. The breach primarily involved full names, phone numbers, email addresses, physical shipping addresses, and order history.

Q: Why did the algorithm fine happen?

A: The KFTC ruled that Coupang acted as both the “umpire” and a “player” by using its search algorithm to give its own Private Brand (PB) products an unfair advantage over the 210,000 independent vendors on the platform.

Coupang remains a logistics miracle, but the events of late 2025 have shown that in a digital economy, trust is as important as speed. As regulators tighten their grip and competitors like AliExpress and Naver move to capture disgruntled users, Coupang’s next year will be defined by its ability to prove it can protect the data of the nation it serves.