Breached E-Commerce Giant Details $1B ‘Customer Trust’ Plan

South Korea’s biggest online retailer, Coupang, said it plans to distribute $1.2 billion in vouchers as part of a plan “to restore customer trust” after suffering a major data breach. Critics have dismissed the vouchers, which can only be redeemed with the retailer, as a marketing ploy rather than true compensation.

See Also: Going Beyond the Copilot Pilot – A CISO’s Perspective

The breach exposed personal information pertaining to 33.7 million customers in a country of 52 million. The security incident has been tied to a Chinese national formerly employed as a developer, with the data theft not coming to light until he demanded a payoff for a promise to not leak the stolen information (see: South Korean E-Commerce Giant Coupang Probes Massive Breach).

Investigators said the leaker subsequently smashed his laptop, dumped it in a river and fled South Korea.

Publicly traded Coupang, founded in South Korea and now headquartered in Seattle, told investors it first learned of the breach on Nov. 18, 2025, and immediately hired Mandiant, Palo Alto Networks and Ernst & Young to handle breach response.

The company first publicly acknowledged the breach on Nov. 29, 2025, and said it’s been coordinating with the South Korean government. “On an almost daily basis” starting last month on Dec. 2, Coupang said it worked with the government to find and contact the leaker. It “secured the leaker’s full confession” as well as multiple computing devices and hard drives, which the company analyzed and gave to the government for its own digital forensic investigation.

The recovered hardware included the leaker’s Windows PC desktop and four hard drives, as well as “the leaker’s MacBook Air laptop from a nearby river.” The leaker told investigators he panicked after seeing news of the breach, smashed his MacBook and put it in a Coupang bag weighted down with bricks before throwing it into the river. Investigators said they matched the serial number of that laptop to the leaker’s iCloud account.

Investigators said they recovered the attack script used, from his personal Windows PC, and that the stolen data appeared to only ever have been moved onto that system and the Apple laptop.

Based on the digital forensic investigation, the leaker accessed 33 million customer account details, using a stolen security key, although he only retained data for about 3,000 customers as well as 2,609 building access codes. The exposed information included names, emails, delivery addresses and phone numbers, but no payment card data, log-in information or order numbers.

Coupang said these findings square with the sworn statement by the leaker, who claims he worked alone, deleted all of the data he stole and never shared it with anyone else.

Founded in 2010, Coupang is often described as being the Amazon of South Korea, and runs a popular Rocket Fast delivery service. As of June 30, the company counted 24.7 million active customers, up 10% year on year.

The company has hit back at critics of its breach response. “At all times Coupang obeyed the government’s order to keep the operation confidential and not disclose any details, even while governmental agencies, the National Assembly and parts of the media falsely accused Coupang of failing to seriously address the leak,” the company said.

The breach led to the resignation of the CEO of Coupang’s South Korean subsidiary on Dec. 10, with Harold L. Rogers, the general counsel and chief administrative officer for the parent company, stepping in to serve as interim CEO (see: Breach Roundup: Coupang Breach Sparks Leadership Shakeup).

One day before the launch of congressional hearings into the breach, the company announced last week a customer compensation plan. This involves distributing four vouchers, worth $35 per customer and collectively $1.2 billion, to each of the 33.7 million affected customers it notified last November.

The vouchers comprise:

• $3.50 toward any Coupang products;
• $3.50 for its Coupang Eats delivery service;
• $14 for its Coupang Travel site;
• $14 for its high-end beauty and fashion product platform R.LUX.

Coupang said customers will receive the vouchers starting on Jan. 15, and that it will notify customers directly, using text messages, about how to retrieve them.

Critics of this compensation plan include the Korea National Council of Consumer Organizations, which described it as being “not compensation for the privacy breach, but rather a marketing tool to induce consumers to make additional purchases and re-subscribe.”

One particular complaint over the company’s self-described “apology” is that the two higher-value vouchers cannot be used without spending much more money, with the least expensive offerings on the company’s travel site costing in the range of $222, reported Korean-language newspaper The Chosun Daily.