Coupang rejects ‘self-investigation’ accusation into data breach

Coupang said Friday it has followed the government’s investigative order and closely cooperated with the authorities, denying claims that the Korean online retail platform service provider independently looked into its recent data breach.

“Unnecessary anxiety has surfaced as false claims of (Coupang) carrying out its own investigation without the government’s supervision are continuously made,” Coupang said in a press release.

“As this data leak incident has caused great concern to the public, we would like to clarify the facts about the process of cooperation with the government.”

Coupang provided a detailed timeline of its cooperation with the government since early December, listing specific dates and discussion points between the two sides.

According to Coupang, the government suggested the company contact the person suspected of leaking data on Dec. 9. Coupang said it met the suspect on Dec. 14 and reported the meeting to the government the same day. Then Coupang claims it retrieved the suspect’s desktop and hard drive and submitted them to the government on Dec. 16.

Coupang added that it had retrieved the suspect’s laptop on Dec. 18 and recorded the forensic evidence as per the government’s order before handing the device over to the government.

The government allowed Coupang to submit evidence and testimonies to the police on Sunday and requested Coupang hold an additional briefing on the details of the investigation Tuesday, according to Coupang.

On Thursday, Coupang announced that it had identified the former employee responsible for the data breach, recovered all devices linked to the incident and submitted them to the governmental authorities.

The online retail giant's disclosure, however, drew criticism as the Ministry of Science and ICT said the claims in the firm's announcement had not yet been confirmed by the private-public joint investigative team. The ministry added that it had lodged a strong complaint to the company over unilaterally disclosing information involving an ongoing probe to the public.