What Coupang's $1.17 Billion Data Breach Teaches Us About Insider Threats

On November 29, 2025, South Korea's largest e-commerce platform Coupang disclosed one of the most devastating data breaches in Asian history. A former employee, using access keys that were never revoked after their departure, silently exfiltrated the personal data of 33.7 million customers over nearly five months. That's roughly 65% of South Korea's entire population.

No malware. No zero-day exploit. No nation-state adversary. Just a single unrevoked credential and the complete absence of monitoring.

The breach would cost Coupang $1.17 billion in direct compensation, trigger the resignation of its CEO, wipe out over $8 billion in market capitalization, and spark multiple US securities class-action lawsuits. South Korea's privacy regulator, the PIPC, is considering fines of up to $900 million under the Personal Information Protection Act (PIPA).

This is the anatomy of that breach, what went wrong, and what organizations building for the future can learn from it.

The Timeline

The Attack: An Insider with Unrevoked Keys

What makes the Coupang breach so alarming is its simplicity. There was no sophisticated malware, no supply-chain compromise, no exploit chain. The MITRE ATT&CK framework classifies this as T1078: Valid Accounts the use of legitimate credentials to access systems.

Here's how it worked:

The attacker didn't need to break in. They still had the keys.

Coupang's authentication system used cryptographic signing keys to generate login tokens. When the employee left, those keys should have been rotated or revoked immediately. They weren't. This meant the former employee could forge tokens that looked identical to legitimate ones, granting full access to customer data without triggering any authentication alarms.

The data that was exposed included full names, phone numbers, email addresses, physical delivery addresses, and order histories. Notably, payment information and passwords were stored separately and were not compromised, which slightly limited the direct financial fraud risk to consumers but does nothing to mitigate the privacy violation and identity-theft exposure.

Five Security Failures (and What Should Have Happened)

The Coupang breach wasn't caused by one failure. It was a cascade of missing controls, each of which independently could have stopped or dramatically limited the damage.

1. No Automated Credential Revocation

What failed: When the employee left Coupang, their cryptographic signing keys remained active. There was no automated process tied to HR offboarding that would revoke or rotate authentication credentials.

What should exist: Every identity whether human or machine should have a lifecycle. When a person leaves, every credential they touched must be revoked automatically, not manually, not "when someone remembers." This includes SSH keys, API tokens, cloud IAM roles, database credentials, signing keys, and VPN certificates.

In EchelonGraph, for example, when a tenant admin clicks Revoke on a scanner agent, the agent's bearer token is invalidated within seconds. The token hash is cleared from the database, and any subsequent API call from that agent returns 401 Unauthorized. One click. Instant. No cleanup ticket sitting in a queue for three weeks.

2. Unencrypted Customer PII

What failed: South Korean law only mandated encryption for payment card data and national identification numbers. Coupang complied with the letter of the law but left customer names, addresses, phone numbers, emails, and order histories completely unencrypted in their databases. This meant that once the attacker had database access, the data was immediately readable.

What should exist: Encrypt all personally identifiable information at rest, regardless of whether the law requires it. Encryption at rest means that even if an attacker accesses the storage layer, the data is useless without the decryption keys, which should be managed separately via a KMS (Key Management Service) with strict access controls and audit logging.

A compliance automation platform would flag this gap continuously. EchelonGraph's compliance engine scores infrastructure against ISMS-P (Korea's combined security and privacy certification) and PIPA controls every 5 minutes. An unencrypted PII column would surface as a failing control the moment it was created, not during an annual audit.

3. Five Months of Undetected Access

What failed: The attacker accessed customer databases from overseas IP addresses for 143 consecutive days (June 24 to November 6) before anyone noticed. There was no behavioral baseline for what "normal" access patterns looked like, no geo-anomaly detection, and no alerting on the volume or origin of data queries.

What should exist: Continuous monitoring with behavioral baselines. If an authentication key is suddenly used from a new geographic region, at unusual hours, or to query volumes of data that don't match historical patterns, that should trigger an immediate alert.

Graph-based security platforms solve this structurally. When EchelonGraph's scanner agents authenticate, every call records last_seen_at and last_seen_ip. If an agent that normally checks in from 10.0.1.0/24 in Seoul suddenly appears from an IP block in another country, the anomaly is visible in real time on the dashboard and would trigger a security alert.

4. No Blast Radius Assessment

What failed: When the breach was first detected on November 6, Coupang's team identified approximately 4,500 compromised accounts. It took 12 more days (until November 18) to realize the actual scope was 33.7 million, a figure 7,500x larger than the initial estimate. This suggests Coupang had no way to quickly assess the blast radius of a compromised credential.

What should exist: When you discover that a credential has been compromised, you should be able to answer immediately: "What can this credential access?" Not in days. In seconds.

This is what graph databases are designed for. A single query like:

MATCH (key:Credential {id: $compromised_key})-[:GRANTS_ACCESS_TO*1..5]->(data:DataStore)
RETURN data.name, data.record_count, data.sensitivity_level

...would instantly show every data store reachable from that key, how many records it contains, and its sensitivity classification. No 12-day scramble. No "we thought it was 4,500 but it was 33.7 million."

5. Delayed Regulatory Disclosure

What failed: Coupang determined the breach was material on November 18. They filed their SEC 8-K report on December 16, 28 days later. The SEC's 2023 cybersecurity disclosure rules require filing within 4 business days of determining materiality. This delay triggered US securities class-action lawsuits and additional regulatory scrutiny.

The PIPC also criticized Coupang for initially describing the incident as an "exposure" rather than a "breach" in its notifications to affected users, calling the language misleading.

What should exist: Continuous compliance dashboards that track disclosure deadlines automatically. When a material incident is confirmed, the clock starts, and the platform should make it impossible to lose track of regulatory filing deadlines across jurisdictions (SEC in the US, PIPC in Korea, GDPR in Europe).

The Financial Reckoning

The total cost of the Coupang breach extends far beyond the data itself:

South Korea has proposed amending PIPA to allow punitive fines of up to 10% of annual revenue for severe or repeated violations, aligning with the EU's GDPR framework. If those amendments had been in effect, Coupang's exposure would have been $2.78 billion.

Meanwhile, US investors have filed securities class-action lawsuits alleging that Coupang's 28-day disclosure delay violated SEC rules, representing one of the first major tests of the SEC's 2023 cybersecurity disclosure requirements.

What This Means for Your Organization

The Coupang breach wasn't exotic. It was a textbook insider-threat scenario enabled by basic control failures. The uncomfortable truth is that most organizations have the same gaps:

The question isn't whether your organization has these gaps. It's whether you'd know about them before an attacker exploits them.

Prevention checklist

How EchelonGraph Addresses These Gaps

EchelonGraph is built for exactly this class of threat. Our platform provides:

The Coupang breach cost $1.17 billion in compensation alone. A platform like EchelonGraph costs a fraction of that and would have caught this in hours, not months.

See your attack surface in 60 seconds Start free trial

Sources