Identity
Coupang's record fine: a signing key nobody rotated
Korea's privacy regulator fined Coupang about 624.7 billion won. How a former engineer's signing key opened 37.5 million records, and the controls to check.
On October 7, Coupang filed two lawsuits at the Seoul Administrative Court against the fines South Korea's Personal Information Protection Commission (PIPC) set in June, and asked the court to suspend them while the cases run. The PIPC fined the e-commerce company 423.575 billion won over its 2025 breach, plus a 16.8 million won administrative penalty, and 201.106 billion won for collecting users' browsing records without a legal basis. Outlets put the total at 624.6 to 624.7 billion won. Dollar conversions range from about $409 million to $462 million depending on the outlet and the exchange date, so the won figures are the reliable ones.
The breach fine is the largest Korea has issued for a single incident, about three times the 134.8 billion won the PIPC imposed on SK Telecom in August 2025. The regulator found that a former Coupang engineer used a signing key he took before leaving to read the personal data of about 37.5 million people, and said the cause was "deficiencies in basic safety management" rather than sophisticated hacking. Any company that signs its own login tokens can check itself for the same gaps.
How the breach happened
Coupang keeps users signed in with an authentication token that its servers check against a signing key. Whoever holds the key can mint a token the servers will accept for any account, without a password. Korea's Ministry of Science and ICT, which led the technical investigation, described the token as an "electronic access badge."
The attacker was a back-end engineer who had designed and built Coupang's backup authentication system. The ministry says he left in November 2024 and took a signing key from that system. Investigators found that keys belonging to departed staff were neither revoked nor rotated, that some were still in use in production, and that copies had been stored on developer PCs. Coupang had no check that could tell a forged badge from one issued through the normal login path.
With the key, the attacker generated tokens and queried account pages directly. According to investigators, he made a test run in January 2025 and then collected data from April to November 2025. The ministry counted about 148 million hits on the delivery address list pages. The exposed data included names, phone numbers, email addresses and delivery addresses. Coupang says payment and login details were not included.
The count of victims is disputed. The PIPC put it at 33,222,472 members and at least 4,338,368 non-members, people whose details customers had entered as delivery recipients. The earlier joint public and private investigation counted 33.67 million accounts. Coupang has said the attacker kept only about 3,000 records and later deleted them.
What the regulator penalised
The PIPC's main finding was poor management of authentication signing keys and weak access controls. CyberInsider's summary of the decision says the keys could be viewed by employees who did not need them and were not rotated when staff left. The regulator also faulted monitoring: Coupang did not notice months of abnormal activity, including millions of suspicious requests against pages holding customer data. Coupang learned of the breach only when a customer passed on an extortion email from the attacker, reporting it to customer service on the night of November 16, 2025.
The investigations also criticised how Coupang handled the incident, and the PIPC counted its non-cooperation against it:
- Korea's Information and Communications Network Act requires a report to the Korea Internet and Security Agency (KISA) within 24 hours of detection. The ministry says Coupang's chief information security officer was told at 4 p.m. on November 17 and the report reached KISA at 9:35 p.m. on November 19, more than 53 hours later, and it planned a fine of up to 30 million won. Reporting in December 2025 gave a KISA filing time of 10:52 p.m. on November 18 instead, so press accounts of the timing differ.
- The regulator asked Coupang four times between December 2025 and January 2026 to notify the non-member victims, and it did not.
- Regulators ordered Coupang to preserve logs on November 21. On November 27 Coupang manually deleted about five months of web access logs and left its automatic deletion running. About 13% of the logs for the attack period are gone, so some victims cannot be identified. The PIPC filed a criminal complaint over this.
The 201.106 billion won fine is a separate case. Through the Coupang Partners affiliate programme, Coupang collected the browsing records of about 11.17 million members on third-party websites and apps: URLs, app names, timestamps and IP addresses, stored in a form that identified users. The PIPC set both fines against Coupang's average annual revenue of about 36 trillion won, with some business lines excluded. The legal cap is 3% of revenue.
What to do: a control checklist
Run this against every system that issues its own tokens, including backup and break-glass login paths like the one the Coupang attacker built.
1. Find every signing key and who can read it
List each key that signs session tokens, JSON Web Tokens (JWTs) or API credentials, and record where it lives. A key should sit in a key management system (KMS) or hardware security module (HSM), with signing done through its API so the private key never leaves. Search your repositories and build logs for key material; tools such as gitleaks or trufflehog will find committed secrets. Anything found in code, config files or a laptop is exposed and needs replacing.
2. Rotate keys when people leave
Add key rotation to the offboarding checklist for anyone who built, deployed or could read an authentication system. Rotating a signing key logs every user out unless the verifier accepts the old and new keys during a short overlap, so practise that before you need it. Then check the KMS audit log to see who accessed each key in the past year and compare the names with your current staff list.
3. Make forged tokens visible
Coupang's tokens passed every check because they were validly signed. Record a token ID at issuance and alert when a request carries one your login service never issued. Watch per-token and per-source request rates on profile and address pages, and alert on lookups for account IDs that do not exist. A long-lived key with no issuance record behind its tokens is the pattern that ran here from April to November.
4. Write down the notification clock
Name the moment detection starts, such as when a credible report reaches security staff, and who files each report. In Korea that means KISA within 24 hours under the network act, and the PIPC under the Personal Information Protection Act. Keep drafted templates and a list of every regulator in every country you serve, each with its deadline.
5. Freeze logs on day one
Add a step to the incident plan that suspends automatic log deletion as soon as an incident is opened, and keep access logs for longer than an attacker is likely to stay hidden. Coupang's attacker was inside for about seven months.
Our compliance and audit readiness work maps controls like these to the regulations you answer to, and our security operations team builds the token and request monitoring that catches forged credentials. Open the chat and Yaali, our AI agent, will pass your question to an engineer.
Sources: Asia Economy (lawsuits), Herald Business (lawsuits), Korea JoongAng Daily (lawsuits), Korea Times, The Record, SBS, UPI, Korea JoongAng Daily (fine), CyberInsider, Reuters via Yahoo Finance, Korea Herald (ministry findings), Korea JoongAng Daily (ministry findings), Korea JoongAng Daily (customer report).