Raid timeline and scope On December 9, 2025, Seoul Metropolitan Police Agency’s cyber investigation team raided Coupang’s Songpa headquarters, seizing internal documents related to the breach [2][3][4]. The operation continued the next day with a second‑day raid, again under a search warrant, to collect further evidence [1]. The warrant names a former employee, a Chinese national, as the primary suspect in breaching the network and leaking data [1][2].

Scale of compromised data Coupang disclosed that personal information of about 33.7 million customers was exposed, including names, phone numbers, email addresses and delivery details [1][2][3][4]. This figure represents more than half of South Korea’s ≈ 52 million population [1][2]. Earlier reports had underestimated the impact, initially citing only ≈ 4,500 affected accounts [3][4].

Investigation focus and digital leads Police have secured the IP address used in the intrusion and are using it to trace the leaker’s route and identify system vulnerabilities [1][3][4]. The investigation aims to map the full leak pathway, determine how the data was accessed, and assess any security lapses in Coupang’s customer‑information management [1][2]. No criminal use of the stolen data has been confirmed yet [3].

Background and prior disclosures The breach was first reported by Coupang on November 18, when it disclosed a breach affecting roughly 4,500 customers [3][4]. Following that, the police began a preliminary inquiry based on voluntarily submitted records from the company [4]. The recent raids represent an escalation from the earlier voluntary‑submission phase to a full‑scale evidence‑seizure operation [2].