Open Korea

Korean Identities Beyond Borders

Korean gov’t confirms 33.67 mil. user records leaked in Coupang breach

in ,
Korean gov't confirms 33.67 mil. user records leaked in Coupang breach

A government-private investigation team confirmed Tuesday that more than 33 million user records of customers in Korea, including names and email addresses, were leaked in last year’s massive data breach by U.S.-headquartered e-commerce giant Coupang.

The confirmation suggested that the company sought to play down the incident by initially claiming only around 3,000 records had been compromised and adding 165,000 more later.

According to the Ministry of Science and ICT, which led the team, the investigation found a total of 33.67 million user records had been compromised, and that the company’s delivery list page containing names, phone numbers, delivery addresses and anonymized apartment entrance passwords was accessed illicitly 148 million times.

“The investigated organization (Coupang) made its own claims and submitte its own investigation outcome,” Choi Woo-hyuk, head of the ministry’s Office of Cybersecurity and Network Policy, said in a briefing in Seoul.

“Coupang’s figure of 3,000 records is the company’s claim and serves only as a reference. We verified all materials independently. We examined Coupang’s servers to determine how much data was accessed by external attackers and how much was leaked.”

According to Choi, the ministry confirmed that “the attacker” was a former Coupang employee who had developed user authentication software, and the person stole a signing key from an authentication system, conducted tests for the attack and then used web-crawling tools to copy large volumes of data.

Through this method, the attacker accessed Coupang’s services even after leaving the company and sent threatening emails to the company’s headquarters. The team also confirmed that the attacker had a system capable of transmitting the leaked data to overseas cloud servers, but said it remains unclear whether any data was actually transmitted.

The investigative team said Coupang’s internal rules stipulate that signing keys must be stored only within the management system and not on employees’ personal PCs, but added that cases were found in which current Coupang developers had stored signing keys on their laptops.
“The team identified shortcomings in the management of authentication systems and signing keys,” Choi said. “This is a clear management failure of Coupang, not a sophisticated attack.”

The ministry said Coupang also failed to report the incident promptly to the relevant authorities despite related regulations, adding it will impose a fine on the company for delayed reporting and pursue a formal investigation, stressing that the company failed to preserve key evidence despite an earlier request.

The investigation results came about three months after Coupang became aware of the breach on Nov. 17. While there had been speculation that the team’s announcement faced delays out of concerns over U.S. trade pressure and American politicians’ claims that the Korean government is discriminating against an American company, the probe team flatly denied the claims.

“The investigation team has never deviated from the law and principles,” Choi said. “We have not treated any company differently, and we are adhering to our principle of disclosing the results promptly and transparently as they become available.”

submitted by /u/coinfwip4
[link] [comments]

Related Posts

SK Square to buy back $72 mn shares amid Palliser’s value-up push MBK-owned Homeplus files for corporate revamp with Seoul court Yoon becomes first S.Korean sitting president to be formally arrested

Latest News from Korea

Latest Entertainment from Korea

Learn People & History of Korea