Key Takeaways
South Korean e-commerce giant Coupang has announced a comprehensive compensation package valued at approximately 1.685 trillion won (roughly $1.2 billion). The Coupang compensation plan aims to restore consumer trust after a significant data breach was disclosed in November, reportedly impacting 33.7 million customers.
The data theft was allegedly orchestrated by a former employee who tried to dispose of the evidence after the incident was publicly disclosed. While the perpetrator accessed 33 million accounts, forensic analysis suggests that data from only about 3,000 accounts was retained before being deleted, but it was “never transferred.”
Investigations confirmed the individual stole an internal security key while still working at the company.
“The perpetrator stated that he used a personal desktop PC and a MacBook Air laptop to provision access and to store a limited amount of user data,” a recent company post said. The perpetrator stated that he “physically smashed” the device and threw it into a river in a bag with bricks.
According to the company, all devices used in the data leak, including the MacBook Air recovered from the river, have been retrieved and turned over to authorities.
Coupang has clarified that its investigation into the Coupang cybersecurity incident was conducted in close coordination with and under the direction of the South Korean government. The joint effort led to the identification of a former employee as the perpetrator.
The company will distribute a total of 50,000 won in purchase vouchers to each of the 33.7 million customers. The distribution will commence sequentially starting January 15 and will apply to all affected customers.
Kim Beom, the founder of Coupang, expressed deep regret for the distress caused by the incident and stated that the compensation plan is part of the company's commitment to taking responsible action, with a renewed focus on "customer-centric principles" to regain the trust of its massive user base.
In July, SK Telecom suffered a data breach, prompting South Korea to enforce strict cybersecurity measures and impose a fine of roughly $21,000.