![\"\"\/](\"https:\/\/www.europesays.com\/korea\/wp-content\/uploads\/2026\/05\/Coupang-feature-1024x477.jpg\")
<\/p>\nThe Coupang Data Breach: A Timeline<\/p>\n
Published February 22, 2026<\/p>\n
<\/p>\n
South Korea\u2019s largest online retailer, Coupang, suffered a massive data breach last year that exposed the personal information of more than 33 million users. The breach triggered a sweeping response from the South Korean government, raising questions about jurisdiction, as Coupang is based in Seattle, Washington.<\/p>\n
This timeline tracks major public developments related to the breach and the legal, regulatory, and congressional activity it has set in motion in the United States and South Korea, updated in reverse chronological order with sources linked to each entry.<\/p>\n
February 27, 2026 <\/p>\n
Bom Kim, founder and CEO of Coupang, apologizes during an investor call<\/a> for the concern caused by the data incident and said the company\u2019s priority is earning customer trust. Coupang interim CEO Harold Rogers reiterated the company\u2019s intention to continue cooperating with South Korean investigations and characterized the incident as a targeted act by a former employee.<\/p>\n February 24, 2026<\/p>\n Rogers attends a closed-door hearing<\/a> hosted by the House Judiciary Committee\u2019s Subcommittee on the Administrative State, Regulatory Reform, and Antitrust, focusing on the Korean government\u2019s treatment of U.S. companies<\/a> in connection with the Coupang dispute. The panel lasts roughly seven hours<\/a>.<\/p>\n February 23, 2026<\/p>\n Coupang states that Rogers met with bipartisan officials<\/a> from the House Judiciary Committee as part of the committee\u2019s investigation and says the company will continue to cooperate.<\/p>\n February 12, 2026<\/p>\n Coupang disputes findings<\/a> from a South Korean government-led investigation, arguing that while investigators cited roughly 50,000 views of pages containing building lobby access codes, only 2,609 accounts with such codes were actually accessed. The company says no secondary harm or dark web activity has been detected.<\/p>\n South Korea\u2019s Ministry of Justice states that three U.S.-based investors\u2014Abrams Capital, Durable Capital Partners, and Foxhaven\u2014submitted additional \u201cnotice of intent<\/a>\u201d filings to join the investor-state dispute settlement (ISDS) process under the U.S.-South Korea Free Trade Agreement\u2019s investment chapter<\/a>, bringing the total number of investors involved to five.<\/p>\n February 11, 2026<\/p>\n A U.S. House Judiciary Committee subpoena is reportedly expected to proceed through a closed-door committee deposition<\/a> rather than a public hearing. Coupang\u2019s interim CEO, Harold Rogers, requests to appear on February 23. The committee\u2019s inquiry seeks company communications related to the Korean government\u2019s actions and frames the deposition as part of an oversight investigation.<\/p>\n February 10, 2026<\/p>\n South Korea\u2019s Ministry of Science and ICT releases the results<\/a> of a joint public-private investigation into the data breach, including findings on the scale of impacted accounts and the extent of access to \u201cdelivery address list\u201d pages. The ministry characterized the breach as \u201ca management problem\u201c rather than a sophisticated cyberattack. The ministry states that a former Coupang engineer who left the company in November 2024 stole an internal signing key that enabled unauthorized access to customer accounts.<\/p>\n February 6, 2026<\/p>\n Yonhap reports that Coupang\u2019s interim CEO appears for questioning<\/a> a second time, which lasts approximately fourteen hours<\/a>, regarding allegations tied to prior testimony and related investigative issues.<\/p>\n Korea\u2019s Personal Information Protection Commission (PIPC) states it is continuing a thorough investigation<\/a> and will verify new reports of additional affected accounts identified during Coupang\u2019s internal review of a \u201cdelivery address list,\u201d including whether the data breach extends beyond registered Coupang users.<\/p>\n The U.S. House Judiciary Committee announces it has issued a subpoena<\/a> to Coupang for documents and communications and requests testimony as part of an oversight investigation focused on the alleged discriminatory targeting of U.S. companies.<\/p>\n Coupang states it will fully cooperate<\/a> with the U.S. House Judiciary Committee\u2019s subpoena, including producing requested documents and providing witness testimony, and says it will continue to cooperate with South Korean investigations related to the incident.<\/p>\n February 5, 2026<\/p>\n Coupang confirms that additional user accounts were affected<\/a> by a \u201cdelivery address list\u201d breach, with at least 165,000 more accounts<\/a> affected. Personal data included names, phone numbers, and addresses.<\/p>\n The U.S. House Judiciary Committee issues a subpoena to Coupang<\/a> as part of a probe into alleged discrimination against U.S. companies. They specifically request that Rogers appear on February 23<\/a> and seek communications between Coupang and South Korean government entities related to the company\u2019s compliance with foreign laws and government-initiated actions, while warning that noncompliance could carry legal consequences under U.S. congressional procedures.<\/p>\n January 30, 2026<\/p>\n Coupang\u2019s interim CEO is questioned by police<\/a>.<\/p>\n January 27, 2026<\/p>\n President Donald Trump announces he will raise tariffs on certain South Korean imports in a Truth Social post<\/a>.<\/p>\n House Judiciary Committee Republicans repost Trump\u2019s tariff threat<\/a>, opining that, \u201cThis is what happens when you unfairly target American companies like Coupang.\u201d This post is shared by leading Republicans, including House Judiciary Committee member Darrell Issa (R-CA)<\/a>, who warns that \u201ctargeting of American companies\u201d like Coupang \u201cwon\u2019t be tolerated.\u201d<\/p>\n January 23, 2026<\/p>\n Coupang says it was not involved<\/a> in an investor petition to the U.S. trade representative.<\/p>\n Korean Prime Minister Kim Min-seok tells U.S. lawmakers there is \u201cabsolutely no discrimination<\/a>\u201c against Coupang, framing the probe as routine enforcement rather than trade discrimination.<\/p>\n January 22, 2026<\/p>\n Two U.S. investment firms, Greenoaks Capital Partners and Altimeter Capital Management, file a petition seeking relief under Section 301 with the Office of the United States Trade Representative<\/a>. They issue a notice of intent<\/a> to the Korean government, stating their intent to pursue arbitration against it and claiming, among other things, that the Lee Jae Myung administration is seeking to undermine U.S. competitiveness on the Korean Peninsula.<\/p>\n January 14, 2026<\/p>\n Reports emerge that the PIPC instructed Coupang to stop publishing unconfirmed information<\/a> related to the incident while the investigation is ongoing.<\/p>\n January 13, 2026<\/p>\n The U.S. House Committee on Ways and Means\u2019 Trade Subcommittee holds a hearing titled \u201cMaintaining American Innovation and Technology Leadership,\u201d which includes references to digital trade and treatment of U.S. firms abroad<\/a>.<\/p>\n At the hearing, Subcommittee Chairman Adrian Smith<\/a> says \u201cKorean regulators\u201d are \u201caggressively targeting U.S. technology leaders.\u201d Chairman Smith added, \u201cOne example would be Coupang through discriminatory regulatory actions.\u201d<\/p>\n December 30, 2025<\/p>\n The National Assembly files a perjury complaint<\/a> against Coupang\u2019s interim CEO after Rogers testified at a joint hearing that Coupang\u2019s internal investigation was conducted at the direction of the National Intelligence Service (NIS) and that the NIS asked the company to contact the former employee responsible for the breach. The NIS denies both claims<\/a> and requests that the National Assembly file the complaint.<\/p>\n December 29, 2025<\/p>\n Coupang unveils a nearly KRW 1.7 trillion (approximately USD 1.2 billion) compensation plan<\/a> for tens of millions of users affected by the data breach.<\/p>\n December 26, 2025<\/p>\n Coupang publishes a detailed account of its cooperation with Korean authorities, pushing back against claims that an internal review was conducted without adequate oversight<\/a>. The company describes weeks of coordination with the government, including efforts to recover devices linked to the breach.<\/p>\n December 25, 2025<\/p>\n Coupang releases a statement<\/a> accusing a former employee of accessing data from roughly 33 million accounts. The firm says the employee saved only about 3,000 user records and did not send any personal data to any third party.<\/p>\n December 3, 2025<\/p>\n The PIPC demands<\/a> that Coupang issue a corrected notice to users, specifying that a \u201cleak\u201d occurred rather than the firm\u2019s earlier description of data \u201cexposure.\u201d<\/p>\n December 2, 2025<\/p>\n President Lee calls for tougher penalties<\/a> against corporate negligence in data breaches during a cabinet meeting, describing personal data protection as a key asset in the age of AI and digitalization.<\/p>\n Coupang\u2019s Chief Information Security Officer, Brett Matthes, tells a National Assembly hearing that the perpetrator likely held a \u201cprivileged role<\/a>\u201d within the organization that would have enabled access to a private encryption key.<\/p>\n December 1, 2025<\/p>\n Reports emerge that the Korean police have opened a probe<\/a> into the breach, including the reported scale of affected customers and the government\u2019s initial investigative posture.<\/p>\n November 29, 2025<\/p>\n Coupang reveals to the public for the first time that the personal data of approximately 33.7 million users<\/a> was leaked and that authorities are investigating.<\/p>\n November 19, 2025<\/p>\n Coupang reports the breach<\/a> to Korean authorities at 9:35 p.m., more than fifty-three hours after internal identification, exceeding the twenty-four-hour reporting requirement under South Korea\u2019s information network law.<\/p>\n November 18, 2025<\/p>\n Coupang internally identifies unauthorized access to customer accounts, initially estimating roughly 4,500 accounts affected. The breach was reportedly discovered only after the former employee sent threatening anonymous emails<\/a> to the company and individual users.<\/p>\n November 13, 2025<\/p>\n The White House<\/a> and the Office of the U.S. Trade Representative<\/a> release fact sheets documenting an understanding between the United States and South Korea on trade and investment as part of the U.S.-Korea trade deal, including language on digital trade later referenced in congressional and investor filings.<\/p>\n The fact sheet states, \u201cThe United States and the ROK commit to ensure that U.S. companies are not discriminated against and do not face unnecessary barriers in terms of laws and policies concerning digital services, including network usage fees and online platform regulations, and to facilitate cross-border transfer of data, including for location, reinsurance, and personal data.\u201d<\/p>\n August 25, 2025<\/p>\n Following a bilateral meeting with President Lee, President Donald Trump warns in a Truth Social post<\/a> that he will impose additional tariffs and export<\/a> restrictions on countries with digital taxes or rules he describes as discriminatory toward U.S. technology.<\/p>\n June 30, 2025<\/p>\n U.S. Representatives Adrian Smith (R-NE) and Carol Miller (R-WV) issue a letter signed by forty-one congressional colleagues<\/a> addressed to U.S. Trade Representative Jamieson Greer, Secretary of the Treasury Scott Bessent, and Secretary of Commerce Howard Lutnick, asking the Trump administration to include digital trade barriers as part of its trade negotiations with Korea.<\/p>\n April 14, 2025<\/p>\n A former Coupang employee begins unauthorized access to the company\u2019s systems, a breach that continues until November 8, 2025, according to findings from a Korean government-led investigation published in February 2026<\/a>. Investigators also identify traces of an earlier attempted intrusion around January 2025.<\/p>\n \u00a0<\/p>\n Yohan Moon is a Researcher at the Korea Economic Institute of America. The views expressed here are the author\u2019s alone.<\/p>\n Feature image from\u00a0Bonnielou2013<\/a>\u00a0via\u00a0CC BY-SA 4.0<\/a><\/p>\n Note: This timeline compiles publicly reported developments and does not reflect the views or analysis of the Korea Economic Institute of America. Entries draw primarily from media reports, as well as government releases, company statements, U.S. congressional documents, and trade filings.<\/p>\n KEI is registered under the FARA as an agent of the Korea Institute for International Economic Policy, a public corporation established by the government of the Republic of Korea. Additional information is available at the Department of Justice, Washington, D.C.<\/p>\n","protected":false},"excerpt":{"rendered":"The Coupang Data Breach: A Timeline Published February 22, 2026 South Korea\u2019s largest online retailer, Coupang, suffered a…\n","protected":false},"author":2,"featured_media":9158,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[381],"tags":[426,119,2333,33,2594],"class_list":{"0":"post-9157","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-coupang","8":"tag-coupang","9":"tag-economy","10":"tag-finance","11":"tag-south-korea","12":"tag-trade"},"_links":{"self":[{"href":"https:\/\/www.europesays.com\/korea\/wp-json\/wp\/v2\/posts\/9157","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.europesays.com\/korea\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.europesays.com\/korea\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/korea\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/korea\/wp-json\/wp\/v2\/comments?post=9157"}],"version-history":[{"count":0,"href":"https:\/\/www.europesays.com\/korea\/wp-json\/wp\/v2\/posts\/9157\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/korea\/wp-json\/wp\/v2\/media\/9158"}],"wp:attachment":[{"href":"https:\/\/www.europesays.com\/korea\/wp-json\/wp\/v2\/media?parent=9157"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.europesays.com\/korea\/wp-json\/wp\/v2\/categories?post=9157"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.europesays.com\/korea\/wp-json\/wp\/v2\/tags?post=9157"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}