Introduction: A Breach of Trust, Not Just Systems

Imagine a fortress so confident in its outer walls that it leaves the master key under the doormat. This, in essence, was the security posture of Coupang, South Korea's e-commerce giant, in 2025. The breach that unfolded was not a story of zero-day exploits or nation-state sophistication, but one of profound internal negligence. A former engineer, armed with intimate knowledge and a stolen digital key, walked through the virtual front door undetected for seven months, accessing the personal data of over 33 million citizens. South Korean regulators delivered a damning verdict: this was "more of a management problem than an advanced attack." This lesson explores how a colossal breach stemmed from failed governance, inadequate controls, and a catastrophic delay in response, offering a masterclass in the human and procedural failures that render technical defences meaningless.

Deconstructing the Attack: Simplicity Over Sophistication

Contrary to the complex cyber-attacks often depicted, the Coupang compromise was executed through a shockingly straightforward vector, highlighting that advanced threats often hide in plain sight within credential management lapses.

Initial Access & Exploitation

The attacker, a former Coupang engineer, did not need to phishing employees or exploit software vulnerabilities. He leveraged his insider knowledge of the company's authentication systems and a stolen internal security signing key. This key was used to generate fraudulent login tokens, effectively allowing him to impersonate valid users at will. This maps directly to the MITRE ATT&CK technique T1556.002 (Modify Authentication Process: Domain Controller Authentication), albeit in a cloud application context. The initial probe occurred in January 2025, with sustained, unauthorized access established from April onwards.

Scope and Scale of Data Exposure

Once inside, the attacker conducted rampant, automated data access. The scale is staggering:

• 33.67 million user accounts had names and email addresses leaked.
• Delivery address lists were accessed a monumental 148-150 million times.
• In a particularly egregious detail, a page containing shared apartment entrance passcodes was queried over 50,000 times.
• An additional 165,000 accounts were implicated in a related subsequent leak.

Notably, the exfiltration was a low-and-slow data scraping operation (T1020 - Automated Exfiltration), viewing pages en masse rather than downloading databases in bulk, which likely aided in evading detection.

The Critical Timeline and Response Failure

The timeline reveals a severe breakdown in security operations and regulatory compliance:

• April - November 2025: Attacker operates undetected for seven months.
• 17 November, 16:00: Coupang's CISO is notified of the breach.
• 19 November, 21:35: Breach reported to authorities—over 53 hours later, blatantly violating South Korea's 24-hour mandatory reporting law.
• Post-discovery, Coupang compounded its error by deleting access logs despite a government preservation order, leading to a criminal referral.

Ripple Effects: Financial, Reputational, and Geopolitical Fallout

The impact of the Coupang breach transcended typical data loss, affecting its bottom line, brand integrity, and even international relations.

Financial and Regulatory Repercussions

Direct costs include substantial fines from the Personal Information Protection Commission (PIPC) and the Ministry of Science and ICT for the delayed reporting and log destruction. Indirect costs are immense: processing 25.6 terabytes of illicitly accessed data and the operational overhaul required. The breach became a trade pawn, with US politicians like Vice-President JD Vance warning South Korea against "penalising" American firms, and President Trump threatening 25% tariffs—elevating a corporate incident to a geopolitical tension point.

Unprecedented Reputational Damage

South Korean regulators labelled this the "most serious data breach" in the nation's e-commerce history, deploying 14 veteran investigators to probe Coupang. The company's credibility was shattered by attempts to downplay the incident as a "data exposure" and by its obstructive behaviour during the investigation. Trust, the cornerstone of e-commerce, was severely eroded.

Compliance Framework Mapping: Where Coupang Fell Short

This breach exemplifies failures across multiple global cybersecurity and privacy frameworks. The table below maps the specific incidents to control failures.