Coupang vehicle. Yonhap News

The information of over 30 million Coupang customers, including their names, phone numbers, and addresses, was leaked not by external hacking but by an insider, it has been determined.

According to a comprehensive report by Yonhap News on the 30th, Coupang customer information was leaked by a Chinese national who had previously worked at Coupang.

The Seoul Metropolitan Police Agency's Cyber Investigation Unit received a complaint from Coupang on the 25th regarding the incident and has launched an investigation into the personal information leak.

However, concerns are being raised that the investigation may face difficulties as the employee is a foreign national, has already resigned from Coupang, and has reportedly left Korea.

While Coupang's complaint filed with the police did not specify the accused, listing them as "unknown person," Coupang had previously indicated that this information leak was not due to external factors such as hacking.

In a statement released on the 20th, Coupang stated, "It has been confirmed that customer personal information was accessed without authorization," and added, "We have confirmed that there are no signs of external intrusion into Coupang's systems and internal network."

Coupang has confirmed that approximately 33.7 million customer accounts have been compromised to date. This corresponds to the information of three out of every four adults in Korea and is estimated to be equivalent to virtually all Coupang accounts.

The leaked information includes customer names, email addresses, phone numbers, addresses, and some order details.

Furthermore, Coupang believes that the attempt to infiltrate information began five months ago, on June 24th.

While major information leaks, such as those involving SK Telecom and KT, were primarily due to hacking, this incident, presumed to be the act of an employee, has revealed flaws in Coupang's internal management.

The scale of Coupang's customer information leak is comparable to the Cyworld/Nate case in 2011, which affected about 35 million people. That incident was also caused by hacking.

SK Telecom's personal information leak, for which it received the largest-ever fine (134.8 billion KRW) from the Personal Information Protection Commission for violations of personal information protection, was also a hacking incident.

Separate from the police investigation, the government has formed a joint public-private investigation team to analyze the cause of the incident.

The Ministry of Science and ICT plans to form a joint public-private investigation team to analyze the cause of the Coupang intrusion and large-scale personal information leak incident and to prepare measures to prevent recurrence.

In parallel, the Personal Information Protection Commission is investigating the incident after receiving leak reports from Coupang twice, on November 20th and 29th.

The Personal Information Protection Commission plans to impose strict sanctions if violations of the safety measures obligation under the Personal Information Protection Act are confirmed.

Yonhap News