Coupang Says Data Leak Perpetrator Did Not Transfer Data to Others

Coupang said that while the perpetrator of a previously announced data leak accessed 33 million accounts, he retained data from only 3,000 accounts, did not transfer the data to others, and later deleted the data when news outlets began reporting the incident.

The company said this in a Thursday (Dec. 25) update in which it shared findings from an ongoing investigation involving Coupang, the South Korean government, three global cybersecurity firms and the perpetrator’s confession.

The perpetrator, who is a former Coupang employee, has been identified and all devices used in the leak have been retrieved, including a laptop that the perpetrator threw in a river, according to the update.

To date, the investigation has found that the perpetrator accessed basic user data using an internal security key he stole while working at Coupang, retained only the order history and building entrance codes for about 3,000 accounts, never transmitted the data to a third party, and deleted the stored data after seeing news reports about the incident, the update said.

The basic data access by the perpetrator included names, emails, addresses and phone numbers; it did not include payment data, log-in data or individual customs numbers, per the update.

“We will provide updates following the investigation and plan to separately announce compensation plans to our customers in the near future,” Coupang said in the update. “Coupang remains fully committed to protecting customer data. We will cooperate fully with the government’s investigation, take all necessary steps to prevent further harm, and strengthen our measures to prevent recurrence.”

It was reported Nov. 30 that Coupang revealed the data breach on Nov. 29 and that the incident exposed personal information of nearly 33.7 million customers, all in South Korea.

The company said it became aware of the data breach on Nov. 18 and reported the incident to authorities.

It was reported Monday (Dec. 22) that Coupon faces an investor class action lawsuit alleging that it violated securities laws after the data breach.

The lawsuit was filed in California and alleges that the eCommerce company, which operates globally and is South Korea’s biggest online retailer, misled investors about its data security practices and failed to disclose the breach in a timely manner.

The post Coupang Says Data Leak Perpetrator Did Not Transfer Data to Others appeared first on PYMNTS.com.