Coupons at Coupang: Korean e-commerce giant compensates for data leak

Contents

The South Korean e-commerce company is allocating nearly two trillion won to compensate its customers for the impact of a data leak – approximately one billion euros. Starting mid-January, all 33 million customers of the group will receive vouchers, albeit with conditions. The perpetrator of the incident, a former employee of the group, accessed millions of data records and saved thousands of access codes.

The data was lost back in June 2025, when the ex-employee accessed customer data such as names, email and delivery addresses, and the order history of Coupang customers. He had gained access to the data using a stolen internal security token. However, the perpetrator did not store it – he only saved several thousand access codes for the front doors of Coupang customers. As Coupang reports, the leaker panicked and disposed of his laptop in a river (stylishly in a fabric bag with a Coupang logo), but handed over a PC along with data storage devices to investigators.

Curiously, it wasn't Korean law enforcement who found the man, seized his devices, and analyzed them, but Coupang itself played detective. However, this was not a “private investigation” but happened in close consultation with the Korean government, according to the company. They also utilized the services of three “global top cybersecurity firms” for forensic investigations, namely Google Mandiant, Palo Alto Networks, and Ernst & Young (EY). The latter recently suffered a defeat in the Federal Court of Justice against the insolvency administrator of Wirecard AG.

50,000 won per person, but…

Coupang's CEO resigned in December, taking responsibility for the incident. All Coupang customers had already been informed about the leak by the end of November and are now receiving compensation. The interim management is digging deep into the company's coffers and is offering each of the 33 million customers vouchers totaling 50,000 won (approx. 29.50 euros).

However, there is a catch to this seemingly generous gesture. The vouchers are not valid for the entire range of goods and services, but are divided into four parts: Affected customers can shop for 5,000 won (approx. 2.95 euros) each in the Coupang Marketplace and at Coupang Eats, while 20,000 won (approx. 11.83 euros) each is allocated to the travel division “Coupang Travel” and R.LUX, Coupang's beauty and luxury shopping app.

Consumer advocates warn about the vouchers

It is precisely this segmentation that lawyers criticize the company for. They argue it forces four separate orders to receive the full compensation amount and thus promotes unnecessary consumption. Furthermore, Coupang is attempting to reduce the financial burden by issuing consumption vouchers instead of monetary compensation.

However, what weighs particularly heavily, as quoted by the newspaper Chosun Daily, is that a clause in the voucher conditions excludes further claims by those affected, cites a victim lawyer. Thus, through the “non-litigation agreement” in the conditions, they are prevented from participating in damage claims. However, law firms are planning such actions together with those affected – and therefore advise against accepting the vouchers.

Coupang: Company under pressure

Coupang, a company almost unknown in Germany, enjoys an Amazon-like status in South Korea and offers not only online shopping with express delivery but also video streaming and food delivery services. The group generates high revenues with its various ventures; in the 2024 fiscal year, it was over thirty billion US dollars. However, the company is facing criticism not only because of the recent data leak but also due to its business practices.

The Korean Ministry of Employment and Labor announced on January 7th that a task force is investigating allegations of illegal dismissals and the concealment of workplace accidents. Several employees of Coupang's logistics division died last year to death.

Furthermore, customers are apparently fleeing in droves, putting Coupang's partners in a difficult situation. Representatives of the gastronomy industry and freelance traders who sell their products on the group's platform have complained of massive revenue declines following the data leak and lamented what they consider to be the company's inadequate response. They also suffer from high price pressure, Chosun quotes the spokesperson of a trader organization. This is “not innovation, but economic murder.”

In Asia's fourth-largest economy, there have been numerous cyberattacks and data leaks over the past year, including one in the government network Onnara. It came to light through an article in the US hacker magazine Phrack – the whole story was presented by two heise editors at 39C3.

(cku)