Extended breach timeline and massive data exposure Unauthorized access began on June 24, 2025 through overseas servers and remained undetected for five months before Coupang discovered it on Nov 18 2025 [2][3][4]. The company later disclosed that personal details of 33.7 million customers—including names, phone numbers, email addresses and delivery addresses—were exposed, while payment information and login credentials were not compromised [1][2][5]. Initial reports mentioned only 4,500 affected accounts, but a subsequent investigation revealed the full scale affecting nearly the entire user base [2][3][4].

Government emergency meeting launches joint investigation On Nov 30 2025, Science Minister Bae Kyung‑hoon convened an inter‑agency emergency meeting, ordering a comprehensive probe into possible violations of data‑protection guidelines [3][4][5]. The investigation involves the Ministry of Science and ICT, the Korean National Police Agency, the Personal Information Protection Commission, the Korea Internet & Security Agency and the Financial Supervisory Service [1][3]. Authorities are assessing both the breach’s cause and any regulatory breaches by Coupang [2][5].

Police identify former Chinese employee as suspect Police reports indicate a former Chinese employee of Coupang, who has left the country, is the primary suspect after a complaint was filed on the Tuesday following the breach’s discovery [2][3][4]. The suspect is believed to have exploited insider knowledge to access the overseas servers [2][4]. Investigators are pursuing the individual for potential violations of security and data‑protection statutes [5].

Coupang’s evolving public communications and safeguards Coupang first notified authorities on Nov 20 and publicly reported only 4,500 records, later expanding the figure to 33.7 million [2][3][5]. CEO Park Dae‑jun issued a public apology on Nov 30, pledging stronger data‑protection measures and full cooperation with investigators [3][4][5]. Following a government request, the company revised its notice on Dec 6 to label the incident explicitly as a data breach and confirmed that no secondary damage—such as phishing or impersonation—has been documented [1].

Comparative context and potential penalties The breach surpasses the April 2025 SK Telecom leak of 23.2 million users, which resulted in a record fine of 134.8 billion won, highlighting the possible financial and regulatory repercussions for Coupang [3][4]. Ongoing investigations may uncover additional compromised data or lead to further sanctions [5].