E-commerce giant Coupang denied parliamentary allegations that a suspect tied to its data breach sought to extort the company by threatening to expose private data relating to thousands of customers.
In a statement Thursday, Coupang said the claim, that the suspect behind the data breach compiled a list of about 3,000 customers who had purchased adult products in an attempt to blackmail the company for money, was baseless.
“Neither the findings of the recent joint public-private investigation nor the suspect’s emails indicate that any payment was demanded,” the company said. “It is unfortunate that inaccurate claims were raised during parliamentary questioning.”
Such claims were raised by Rep. Kim Seung-won of the Democratic Party of Korea during a parliamentary session Thursday. “A vast amount of our people’s personal information is being exploited by criminal groups,” Kim said, calling for stronger measures to prevent further harm.
The session also touched on an upcoming US House Judiciary Committee hearing involving Coupang interim CEO Harold Rogers, as part of a probe into alleged discriminatory targeting of American companies by Korea. In response, Prime Minister Kim Min-seok said relevant agencies are providing factual information to US authorities to avoid misunderstandings about the case.
Tensions had already been simmering between Korean authorities and Coupang over the scope of a data breach.
On Tuesday, the Ministry of Science and ICT said 33.67 million user records, including names and email addresses, were exposed through Coupang’s account information system, with the delivery address page accessed more than 148 million times.
Coupang countered that webpage access figures should not be equated with confirmed data leakage, describing the activity as attempts to gather information rather than data extraction. The company previously said data from only about 3,000 accounts were stored, albeit information tied to more than 33 million accounts was accessed.
It also contended that the investigation report failed to note that access to building entrance codes, reported at more than 50,000 instances, was limited to 2,609 accounts.
Coupang reiterated that the former employee involved in the case did not access highly sensitive customer information, including payment details, passwords or government-issued identification documents.
Regarding potential secondary harm, Coupang noted that cybersecurity firms were continuously monitoring dark web marketplaces, encrypted messaging services and other platforms. “No evidence of secondary misuse of leaked customer information has been detected,” the company said.
minmin@heraldcorp.com
