Incident disclosureDisclosed 2025-12-16Coupang, Inc.SEC filing

Coupang, Inc. discloses a cybersecurity incident (SEC 8-K, December 2025)

On November 18, 2025, Coupang Corp. (“Coupang Corp.”), a wholly-owned Korean subsidiary of Coupang, Inc. (Coupang Corp., together with Coupang, Inc.

What happened

  • On November 18, 2025, Coupang Corp. (“Coupang Corp.”), a wholly-owned Korean subsidiary of Coupang, Inc. (Coupang Corp., together with Coupang, Inc. (“Coupang, Inc.,” “our,” or “we”) and its subsidiaries and affiliates, “Coupang,”), became aware of a cybersecurity incident involving unauthorized access to customer accounts (the “Incident”).Form 8-K Item 1.05, Coupang, Inc., filed 2025-12-16
  • Upon discovery, Coupang activated its incident response processes, disabled the threat actor’s unauthorized access, reported the Incident to the relevant Korean regulatory and law enforcement authorities, and warned customers whose data was potentially accessed.Form 8-K Item 1.05, Coupang, Inc., filed 2025-12-16
  • Based on investigative findings, Coupang has determined that a former employee may have obtained the name, phone number, delivery address, and email address associated with up to 33 million customer accounts, and certain order histories for a subset of the impacted acc ounts.Form 8-K Item 1.05, Coupang, Inc., filed 2025-12-16
  • Coupang’s operations have not been materially disrupted.Form 8-K Item 1.05, Coupang, Inc., filed 2025-12-16

The failure pattern

Weak or phishable authentication on a privileged pathA password, an SMS code or a help-desk reset is all that stands between an attacker and admin access.How to prevent it Insufficient segmentation lets a foothold spreadOne compromised account, vendor or network segment reaches management planes, backups and everything else.How to prevent it
Watch the pattern: Weak or phishable authentication on a privileged path

Related standards

CollectSEA's mapping through this incident's failure pattern; not an official determination by the standards bodies.

Building something similar?

Describe your design and see every precedent that applies, with safeguards you can hand to your coding agent.

Analyze your design

Incidents with the same pattern