Citizens walk past Coupang. Yonhap News

Coupang announced on the 29th that it has confirmed that 33.7 million customer accounts had their personal information exposed.

Coupang stated on the 18th that it became aware of unauthorized personal information exposure for approximately 4,500 accounts, but subsequent investigations revealed that the number of accounts with exposed information was 7,500 times higher.

Coupang stated that the exposed information includes names, email addresses, names, phone numbers, and addresses entered in the delivery address book, and some order information.

Payment information, credit card numbers, and login information, which are managed separately, were not included, and therefore customers do not need to take any separate actions regarding their accounts.

However, given the widespread nature of the personal information exposure, which is estimated to encompass nearly all of Coupang's customers, and the delayed identification of the affected accounts, consumer concerns are understandable.

According to the incident report previously submitted by Coupang to the Korea Internet & Security Agency (KISA), Coupang experienced unauthorized access to its account information on June 6th at 6:38 PM, and became aware of this on the 18th, 12 days later, at 10:52 PM.

The accounts with unauthorized personal information exposure that Coupang disclosed this time appear to be virtually the majority of Coupang customers.

Coupang has never publicly disclosed its total number of members.

However, based on information mentioned during the third-quarter earnings announcement, there are 24.7 million active customers (customers with purchase history) in the product commerce division.

The number of Coupang Wow members, a paid membership service, is known to be 14 million as of the end of 2023.

The number of exposed accounts is higher than the known number of customers.

In a press release, Coupang stated, "Based on the investigation results to date, it is estimated that unauthorized access to personal information occurred via an overseas server from June 24th of this year," and added, "(Currently,) the unauthorized access path has been blocked, and internal monitoring has been strengthened."

Coupang also added that immediately after becoming aware of the personal information exposure in mid-month, they engaged independent security company experts to conduct their own investigation, while continuously cooperating with the National Police Agency, KISA, and the Personal Information Protection Commission.

Coupang also urged customers, "We sincerely apologize for all the concerns caused by this incident," and advised, "Please be cautious of phone calls, text messages, or other communications impersonating Coupang."

Yonhap News