How can organizations prevent similar data breaches?

Implementing zero trust architectures, strong segmentation, end-to-end encryption, and continuous threat detection helps prevent unauthorized data access and minimizes the impact of breaches.

Coupang Data Breach 2024: 33 Million Customers Exposed in Massive Retail Incident

Q: What types of customer information were exposed?

The breach exposed personal details including names, phone numbers, addresses, and partial payment information of 33.7 million Coupang customers.

Coupang, South Korea’s retail giant, faces a historic data breach compromising the private information of over 33 million customers. This incident highlights critical security and compliance challenges for global e-commerce leaders.

Published: January 10, 2026

Share this on:

Executive Summary

In early 2024, Coupang, South Korea's largest online retailer, reported a significant data breach affecting approximately 33.7 million customers. The incident involved unauthorized access to personal information, potentially including customer names, phone numbers, addresses, and partial payment details. Coupang disclosed the breach after detecting unusual access patterns and subsequently notified both customers and regulatory authorities. Initial investigations suggest attackers exploited vulnerabilities in Coupang's data management or access controls, raising concerns over the safeguarding of sensitive information in large-scale e-commerce environments.

This breach is especially notable due to the unprecedented scale within the South Korean retail industry and highlights a broader trend of cybercriminals targeting high-profile, data-rich organizations. With customer trust and regulatory scrutiny at stake, organizations globally are urged to reassess their data security and compliance strategies.

Why This Matters Now

This incident underscores the increasing frequency and impact of mega-breaches in the retail sector, where vast amounts of personal data are attractive targets for cybercriminals. The urgency is heightened by stricter data protection regulations and the potential for mass identity theft or fraud, compelling enterprises to upgrade security controls and incident response capabilities immediately.

Attack Path Analysis

Attackers likely gained an initial foothold in Coupang's cloud estate via compromised credentials or exposed interface. They escalated privileges to access sensitive customer records, then moved laterally across workloads and regions to broaden access. Once inside, adversaries established command and control channels to coordinate actions and maintain persistence. Data was exfiltrated—potentially via stealthy outbound channels or cloud-native exports—impacting 33.7 million customers. The breach resulted in widespread exposure of personal information, causing major privacy and reputational impact.

Kill Chain Progression

Initial Compromise

Mediuminferred

Privilege Escalation

Medium

Lateral Movement

Lowinferred

Command & Control

Lowinferred

Exfiltration

High

Impact

High

Initial Compromise

Description

The attacker gained access to cloud resources, likely through stolen credentials or exploiting an exposed API or misconfigured cloud service.

Confidence:

Medium

MITRE ATT&CK® Techniques

Initial Access

T1078

Valid Accounts

Initial Access

T1190

Exploit Public-Facing Application

Exfiltration

T1041

Exfiltration Over C2 Channel

Impact

T1565.001

Data Manipulation: Stored Data Manipulation

Collection

T1530

Data from Cloud Storage Object

Credential Access

T1110

Brute Force

Credential Access

T1552

Unsecured Credentials

Potential Compliance Exposure

Mapping incident impact across multiple compliance frameworks.

PCI DSS 4.0 – Strong Authentication Management

Control ID: 8.3.1

The breach indicates inadequate authentication controls, likely failing to ensure only authorized users access sensitive customer information.

NYDFS 23 NYCRR 500 – Cybersecurity Policy

Control ID: 500.03

The exposure of massive customer data suggests gaps in cybersecurity policies, including insufficient data protection and incident response measures.

DORA – ICT Risk Management Framework

Control ID: Art. 10

The incident demonstrates a lack of robust ICT risk management to prevent data compromise and maintain operational resilience.

CISA ZTMM 2.0 – Data Protection and Access Controls

Control ID: Data Pillar - Protect

Uncontrolled access to sensitive customer data suggests insufficient data segmentation, tagging, and access enforcement per Zero Trust principles.

NIS2 Directive – Cybersecurity Risk Management Measures

Control ID: Art. 21

The breach highlights a failure to implement appropriate technical and organizational security measures to safeguard essential retail services.

ISO/IEC 27001:2022 – Information Classification and Handling

Control ID: A.8.2

Personal data exposure signals inadequate classification, protection, and handling of sensitive customer information in alignment with information security best practices.

Sector Implications

Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.

Retail Industry

Direct exposure to customer data breaches affecting millions requires enhanced segmentation, encrypted traffic, and threat detection capabilities to prevent lateral movement and data exfiltration.

E-Learning

Online platforms storing personal data face similar breach risks, necessitating zero trust segmentation, multicloud visibility, and egress security to protect educational records and user information.

Financial Services

High-value customer databases require comprehensive threat detection, encrypted traffic protection, and policy enforcement to prevent data breaches and maintain regulatory compliance frameworks like PCI DSS.

Health Care / Life Sciences

Patient data protection demands inline IPS, kubernetes security, and anomaly detection capabilities to meet HIPAA compliance requirements and prevent healthcare information breaches.

Sources

Retail giant Coupang data breach impacts 33.7 million customershttps://www.bleepingcomputer.com/news/security/retail-giant-coupang-suffers-data-breach-impacting-337-million-people/
Verified

Korea’s Coupang says data breach exposed nearly 34M customers’ personal informationhttps://techcrunch.com/2025/12/01/koreas-coupang-says-data-breach-exposed-nearly-34m-customers-personal-information/

Verified

Update on Coupang Korea Cybersecurity Incidenthttps://www.aboutcoupang.com/English/news/news-details/2025/update-on-coupang-korea-cybersecurity-incident/

Verified

Coupang to split $1.17 billion among 33.7 million data breach victimshttps://www.bleepingcomputer.com/news/security/coupang-to-split-117-billion-among-337-million-data-breach-victims/

Verified

Frequently Asked Questions

The breach revealed gaps in data access controls, encryption in transit, and monitoring capabilities, potentially affecting compliance with global standards like PCI DSS, HIPAA, and NIST frameworks.

Cloud Native Security Fabric Mitigations and ControlsCNSF

Comprehensive zero trust segmentation, east-west controls, and strict egress enforcement would have restricted movement, flagged anomalies, and contained exfiltration, significantly reducing breach scope. Real-time visibility and inline policy enforcement deter adversary dwell time and lateral traversal.

Initial Compromise

Control: Cloud Firewall (ACF)

Mitigation: Blocked access from unauthorized sources at the cloud perimeter.

Privilege Escalation

Control: Zero Trust Segmentation

Mitigation: Prevented unauthorized privilege elevation between workloads.

Lateral Movement

Control: East-West Traffic Security

Mitigation: Blocked or alerted on unauthorized lateral movement within cloud networks.

Command & Control

Control: Threat Detection & Anomaly Response

Mitigation: Detected and alerted on anomalous outbound communications.

Exfiltration

Control: Egress Security & Policy Enforcement

Mitigation: Stopped data exfiltration via strong outbound filtering and inspection.

Impact (Mitigations)

Minimized scope and impact by rapidly detecting and containing threats.

Impact at a Glance

Affected Business Functions

Customer Service
Order Processing
Logistics
Marketing

Operational Disruption

Estimated downtime: N/A

Financial Impact

Estimated loss: $1,170,000,000

Data Exposure

The personal information of approximately 33.7 million customers was exposed, including names, email addresses, phone numbers, shipping addresses, and certain order histories. Payment information and login credentials were not compromised.

Recommended Actions

• Enforce granular zero trust segmentation and least privilege policies across all cloud workloads and regions.
• Implement comprehensive east-west traffic security and rigorous egress filtering to block lateral movement and data exfiltration.
• Deploy real-time threat detection and anomaly response tools to surface and respond quickly to suspicious activities.
• Strengthen cloud firewalls and monitor all perimeter access points to prevent unauthorized entry and cloud resource abuse.
• Continuously review and enhance visibility, logging, and automated response capabilities across multicloud environments.

Secure the Paths Between Cloud Workloads

A cloud-native security fabric that enforces Zero Trust across workload communication—reducing attack paths, compliance risk, and operational complexity.

Stop Advanced Threats Get a Free Workload Attack Path Assessment Under Active Attack?

Coupang Data Breach 2024: 33 Million Customers Exposed in Massive Retail Incident

Executive Summary

Why This Matters Now

Attack Path Analysis

Kill Chain Progression

Initial Compromise

Description

MITRE ATT&CK® Techniques

Valid Accounts

Exploit Public-Facing Application

Exfiltration Over C2 Channel

Data Manipulation: Stored Data Manipulation

Data from Cloud Storage Object

Brute Force

Unsecured Credentials

Potential Compliance Exposure

PCI DSS 4.0 – Strong Authentication Management

NYDFS 23 NYCRR 500 – Cybersecurity Policy

DORA – ICT Risk Management Framework

CISA ZTMM 2.0 – Data Protection and Access Controls

NIS2 Directive – Cybersecurity Risk Management Measures

ISO/IEC 27001:2022 – Information Classification and Handling

Sector Implications

Retail Industry

E-Learning

Financial Services

Health Care / Life Sciences

Sources

Frequently Asked Questions

Cloud Native Security Fabric Mitigations and ControlsCNSF

Impact at a Glance

Affected Business Functions

Recommended Actions

Key Takeaways & Next Steps

Secure the Paths Between Cloud Workloads