Seoul: A joint public-private investigation into a significant data breach at the South Korean unit of the U.S.-listed e-commerce giant Coupang Inc. has unveiled that over 33.6 million accounts have been compromised, far exceeding the company's initial claims of only 3,000 affected accounts. The disclosure comes from the Ministry of Science and ICT, suggesting Coupang may have attempted to downplay the severity of the incident.
According to Yonhap News Agency, the South Korean unit, Coupang Corp., also neglected to promptly report the breach despite existing regulations. Choi Woo-hyuk, director general of the ministry's cybersecurity bureau, labeled the incident as a major breach leading to an extensive leak of information from the country's leading online commerce platform. Choi emphasized the investigation was thorough, fair, and transparent.
As a result of the findings, the ministry plans to impose a fine on Coupang for the delayed reporting and will initiate a formal investigation, noting the company's failure to preserve critical evidence despite earlier requests. The breach, reported by Coupang in November, exposed personal information including names, phone numbers, email addresses, and delivery details, affecting nearly all of the company's user base.
Coupang had initially cited its investigation, claiming only 3,000 accounts were affected, which drew public criticism. Recently, Coupang reported an additional data leak affecting over 165,000 accounts, which was not included in the joint probe's findings. The breach could impact roughly two-thirds of South Korea's population, given Coupang's popularity as a platform for overnight delivery services.
The investigation analyzed 25.6 terabytes of web access logs, revealing that 33.67 million users' information, including shared entrance door passwords, was leaked. This suggests the number of victims could rise, considering account holders can have goods delivered to others by providing their contact information. The breach occurred due to attackers exploiting vulnerabilities in Coupang's authentication system, bypassing normal procedures.
Choi noted that the breach was more a matter of management oversight than a sophisticated attack, urging Coupang to enhance monitoring of abnormal access and to establish a log retention policy. The probe did not delve into the involvement of a former employee suspected of causing the breach, as this investigation falls under police jurisdiction. No evidence of the data circulating on dark web platforms was found.
The ministry highlighted that Coupang became aware of the breach on Nov. 17 but failed to report it until Nov. 19, surpassing the 24-hour reporting requirement. Such delays are subject to fines up to 30 million won (US$20,560). Additionally, the ministry seeks a separate investigation into Coupang's failure to preserve evidence, as crucial web access records could not be found.
Coupang has been instructed to submit measures to prevent future breaches and will be inspected on their implementation. The company insists that no secondary damage has resulted from the breach, stating unauthorized views do not equate to data theft. Coupang maintains full cooperation with the investigation and transparency in disclosing all relevant information.