Breach Teardown
What Caused the Coupang Breach?
South Korea’s most serious e-commerce breach needed no phishing, no malware, and no stolen password. According to the government’s investigation, a former developer of Coupang’s authentication system had obtained a token signing key, nobody revoked or rotated it after the developer left, and for seven months it was used to forge the credentials that tell Coupang’s servers a customer is already signed in.
By Vidyaa Ganesh, Founder, Identara
- Scale
- 33.67M records (per Ministry of Science and ICT); ~37.5M people (per PIPC)
- Attack vector
- Ex-employee forged login tokens with a never-rotated signing key
- IAM domains implicated
- PAM, IGA, Security, CIAM × Data
- Domino controls hit
- 2 of 4
The Incident
What Happened
Coupang disclosed a data breach in November 2025, initially reported at roughly 4,500 accounts; by late November the company had raised its own count to about 33.7 million. On February 10, 2026, the Ministry of Science and ICT announced the findings of a joint public-private investigation, calling it the most serious data breach ever to hit the country’s e-commerce sector: more than 33.67 million user records, including names and email addresses, had been accessed between April and November 2025 from more than 2,300 IP addresses, and the activity had continued for months without being noticed.
Per the ministry, the person responsible was a former developer who had worked on Coupang’s user authentication system and obtained a signing key while still employed. After leaving, the developer used it to forge what investigators called an “electronic access badge,” a credential that let requests into customer accounts without a normal login. Investigators found that signing keys belonging to former employees were neither revoked nor rotated, that keys were stored on developer PCs, and that forged credentials were not subject to verification. The delivery address page alone was accessed more than 148 million times, and about 50,000 views of the delivery-editing page exposed door passcodes for shared residential entrances.
In June 2026, the Personal Information Protection Commission put the affected population at about 37.5 million people: 33.2 million members and at least 4.3 million non-members who appeared in delivery records. It issued fines totaling ₩624.7 billion (roughly $460 million) across the breach and related violations, attributing the breach to inadequate management of authentication signing keys and insufficient monitoring of suspicious activity, and calling it the product of basic security failures rather than sophisticated hacking. Coupang has appealed the penalty to the Seoul Administrative Court, and an executive was summoned before the National Assembly on October 12, 2026.
Attack Chain
How the Attack Compounded
Each step below marks the AXIS control that failed at that point in the chain, where one applies. Steps without a control marker were outside the victim's direct span of control.
Per investigators, a developer on Coupang’s user authentication system obtains a token signing key while still employed.
PAM-02
The developer leaves. Signing keys belonging to former employees are neither revoked nor rotated, so the key keeps working.
IGA-01
Between April and November 2025, the key is used to forge “electronic access badges” that open customer accounts without a login. Forged credentials are never verified.
PAM-02
Over seven months, requests arrive from more than 2,300 IP addresses and the delivery address page alone is accessed over 148 million times, without detection.
SEC-03
Each forged session reaches names, phone numbers, and street addresses, and in about 50,000 views, building entrance passcodes.
CIAM-DATA-01
The government counts 33.67 million records; the PIPC fines Coupang ₩624.7 billion across the breach and related violations.
Control Mapping
The IAM Controls That Failed
Every failure point below is a capability in the AXIS IAM capability model: the same 4 controls an IAM maturity assessment would have scored before this incident.
| Control | Domain | Capability | How it failed here |
|---|---|---|---|
| PAM-02 Domino | PAM | Secrets Management (Non-Human & Application Credentials) | A key that can mint valid customer sessions is the most sensitive secret an authentication team owns. Per the PIPC, it could be viewed by employees who did not need it; investigators also found keys stored on developer PCs, never rotated, and the tokens it signed were accepted without further verification. Secrets maturity is measured by whether a key like that can leave the building at all. |
| IGA-01 Domino | IGA | Lifecycle Management (Joiner / Mover / Leaver) | Offboarding removed a person and left their credential behind. Lifecycle management for engineers who touch authentication systems has to cover the secrets they could reach, rotating every key a leaver had access to, not just disabling a directory account. |
| SEC-03 | Security | User Behavioral Analytics (UBA) | Seven months of requests from more than 2,300 IP addresses, with one page hit over 148 million times, is a volume and pattern anomaly on every axis. The PIPC cited insufficient monitoring of suspicious activity: behavior on customer sessions after authentication was not being baselined. |
| CIAM-DATA-01 | CIAM × Data | Customer Access-to-Data Visibility & Impact Control | A forged customer session could read delivery addresses, phone numbers, and the door codes for shared residential entrances. Nobody had bounded what one customer identity exposes, so a single stolen key multiplied into a nation-scale dataset with physical-security consequences. |
The Maturity Lesson
What Would Have Changed the Outcome
The Domino Effect
IGA-01 and PAM-02 are both domino controls, and Coupang is the rare case where they failed as a single event: a leaver whose secret outlived the employment. The AXIS model scores lifecycle management and secrets management separately, and this breach shows the seam between them. Disabling the account is lifecycle work; rotating every key the person could reach is secrets work. When neither owns that handoff, a departure becomes a backdoor, and customer-facing controls stop mattering because a forged token never asks for a login.
The Maturity Level That Mattered
At level 2 or higher on PAM-02, signing keys live in a managed key service or HSM with automated rotation, so no individual can copy one to a laptop, and a key that leaves anyway expires on schedule. At level 2 on IGA-01, leaver events for engineers with authentication-system access trigger rotation of every secret in their reach, not only account deactivation.
The assessment question this breach adds: for each person who has left your identity or platform teams in the past two years, which signing keys, tokens, and certificates could they have copied, and has every one been rotated since? Few organizations can answer it, and South Korea’s regulator called the consequences of not answering it a basic security failure.
Related Compliance Frameworks
The controls implicated in this breach carry citations in these frameworks within the AXIS bank:
Put a Number on It
What Would a Breach Like This Cost You?
The breach cost calculator turns a failure pattern like the one above into a dollar figure. Set your identity count, pick your industry, give an honest read of your IAM maturity, and see the annualized loss exposure it implies.
Run the Breach Cost CalculatorSources
About This Analysis
This teardown is based exclusively on public disclosures, regulatory findings, and reporting cited above; it makes no claim of insider knowledge about the internal environment at Coupang. Control mappings express how the publicly documented failure points correspond to capabilities in the AXIS methodology, for educational purposes. AXIS is not affiliated with Coupang.
More From the Breach Radar
Would Your Program Have Caught This?
The 4 controls that failed here are questions in the AXIS assessment. Score your organization against them, and the rest of the bank, in about 20 minutes. No signup required to start.