Coupang Obstructed Korean Probe Into Data Breach, Ministry Says

Why It Matters

The incident highlights escalating regulatory pressure on global tech firms and underscores how data‑security failures can trigger cross‑border trade disputes and reputational damage.

Key Takeaways

• 34 million Korean users' data exposed in Coupang breach
• Former engineer accessed 25.6 TB, April‑November 2025
• Coupang deleted logs, obstructing official investigation
• US officials defend Coupang, warning trade retaliation
• Korean ministries launch parallel probes into breach

Pulse Analysis

The Coupang breach underscores a growing vulnerability in fast‑growing e‑commerce ecosystems, where rapid scaling often outpaces robust security controls. The intruder, a former staff engineer, leveraged a known system weakness to siphon 25.6 terabytes of data, including names, phone numbers, addresses, and building access codes. Such a volume of personal information, spanning millions of accounts, amplifies the risk of identity theft and fraud, prompting heightened scrutiny from privacy regulators worldwide.

Beyond the technical fallout, Coupang’s alleged deletion of access logs and resistance to preservation orders has triggered a multi‑agency response in South Korea. The Ministry of Science and ICT, the Personal Information Protection Commission, and the National Policy Agency are each conducting investigations, reflecting a coordinated effort to enforce data‑protection statutes. The episode has also spilled into geopolitics, with U.S. officials framing punitive actions as an attack on American‑listed tech firms, while President Trump’s tariff threats illustrate how cybersecurity breaches can quickly become trade leverage.

For the broader market, the case serves as a cautionary tale about corporate governance and lobbying. Coupang’s $5.5 million lobbying spend in Washington has already mobilized U.S. policymakers to intervene, yet the company still faces criminal charges against executives, some of whom hold U.S. citizenship. As regulators tighten data‑privacy frameworks across Asia and the West, e‑commerce players must prioritize transparent incident response and invest in resilient security architectures to safeguard consumer trust and avoid costly diplomatic fallout.

Coupang Obstructed Korean Probe Into Data Breach, Ministry Says

February 10, 2026 at 5:00 AM UTC

Coupang staff obstructed a Korean government probe into a massive breach of customer data by deleting sensitive information, the ministry carrying out the investigation said, adding the country’s largest e‑commerce firm defied an order to preserve access logs and other data.

Korea’s Ministry of Science and ICT said in a report published on Tuesday that the breach exposed private data of nearly 34 million customers, rejecting Coupang’s claim that the amount of people affected was far smaller. The report, which was the result of a joint public‑private investigation, said the intruder was a former staff engineer who had compromised personal data including names, phone numbers, addresses and building access codes.

The incident has boiled over into a geopolitical spat between the US and South Korea, with Vice President JD Vance casting Korea’s crackdown on Coupang Inc., which is listed in New York but does business mostly in Korea, as an assault on America’s tech industry. President Donald Trump has also threatened 25 % tariffs on the country.

The report offered fresh details about the breach, including claims by the intruder that customers in Japan and Taiwan were affected. It also included English correspondence between the intruder and Coupang officials, which read: “due to a not‑so‑hard‑to‑find vulnerability in Coupang’s system, billions of user privacy data items are at significant risk of leak.”

The former engineer exposed 25.6 terabytes of data and accessed the Coupang system between April and November, according to the report. The intruder had tested the same vulnerability as early as January last year, it said.

The science ministry is just one of several groups probing the data breach. It said Korea’s Personal Information Protection Commission would follow up with more details on the leaked data. The Korean National Policy Agency is also conducting an investigation, while other relevant ministries are also reviewing issues within their respective jurisdictions, the ministry said.

Coupang has said the probe—which has included office raids, punitive actions from at least 11 Korean government agencies and criminal charges lobbed against company executives, some of whom are US citizens—is unfair. Coupang’s lobbying efforts in Washington, which have cost the company at least $5.5 million in the last two years, have helped and have mobilized US officials to rally on the company’s behalf.

Read More: Coupang’s Influence Campaign Creates Powerful Washington Allies