Coupang breach affecting 33.7 million users raises data protection questions

BleepingComputer

December 22, 2025 at 2:00 PM

Overview

Coupang has reported a significant data breach affecting 33.7 million customers, with unauthorized access to personal data occurring for nearly five months before it was detected. This incident raises serious concerns about the security of customer information, particularly regarding the risks of insider credential abuse. Experts suggest that companies should consider encrypting customer data beyond what is legally required to minimize exposure and potential damage from such breaches. The scale of this breach not only impacts Coupang's customer trust but also emphasizes the need for stronger data protection measures across the industry. As data breaches become more common, organizations must prioritize safeguarding user information to prevent similar incidents in the future.

Key Takeaways

Affected Systems: Coupang customer data, including personal information of 33.7 million users.
Action Required: Companies should implement stronger encryption practices for customer data.
Timeline: Disclosed on [date not specified]

Original Article Summary

Coupang disclosed a data breach affecting 33.7 million customers after unauthorized access to personal data went undetected for nearly five months. Penta Security explains how the incident highlights insider credential abuse risks and why encrypting customer data beyond legal requirements can reduce exposure and limit damage. [...]

Impact

Coupang customer data, including personal information of 33.7 million users.

Exploitation Status

No active exploitation has been reported at this time. However, organizations should still apply patches promptly as proof-of-concept code may exist.

Timeline

Disclosed on [date not specified]

Remediation

Companies should implement stronger encryption practices for customer data.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Data Breach.

Read Original Article

Related Coverage

FTC bans GM from selling drivers' location data for five years

BleepingComputer

The Federal Trade Commission (FTC) has reached an agreement with General Motors (GM) after charging the company with improperly collecting and selling the location and driving data of millions of drivers without their consent. This order prohibits GM from selling this data for five years, ensuring that drivers' privacy is better protected moving forward. The FTC's action underscores the importance of consumer consent in the collection of personal data, especially in an era where location tracking is prevalent in vehicles. The settlement aims to hold GM accountable for its practices and serves as a warning to other companies about the need to respect consumer privacy rights. Millions of drivers who use GM vehicles are affected by this decision, which seeks to restore trust in how their data is handled.

Jan 15, 2026

Lumen disrupts AISURU and Kimwolf botnet by blocking over 550 C2 servers

Security Affairs

Lumen's Black Lotus Labs has successfully disrupted a significant portion of the AISURU and Kimwolf botnet by blocking over 550 command-and-control (C2) servers. This botnet is notorious for facilitating DDoS attacks and proxy abuse, acting as a DDoS-for-hire service that has been used to target various organizations. By taking these C2 servers offline, Lumen aims to reduce the operational capabilities of this botnet, which has been a persistent problem for cybersecurity professionals. The disruption not only impacts the botnet operators but also helps protect potential victims from being targeted in future attacks. This action underscores the ongoing battle against cybercrime and highlights the importance of proactive measures in cybersecurity.

Jan 15, 2026

Palo Alto Networks warns of DoS bug letting hackers disable firewalls

BleepingComputer

Palo Alto Networks has released a patch for a serious vulnerability that could enable attackers to conduct denial-of-service (DoS) attacks, effectively disabling firewall protections. This flaw allows unauthenticated individuals to exploit the vulnerability, raising concerns for organizations relying on Palo Alto's security products. The ability to disable firewalls poses significant risks, as it could lead to unauthorized access and data breaches. Companies using affected products are urged to apply the patch immediately to safeguard their networks. This incident serves as a reminder of the ongoing challenges in maintaining cybersecurity defenses against evolving threats.

Jan 15, 2026

Palo Alto Fixes GlobalProtect DoS Flaw That Can Crash Firewalls Without Login

The Hacker News

Palo Alto Networks has addressed a serious vulnerability in its GlobalProtect Gateway and Portal software, identified as CVE-2026-0227, which carries a CVSS score of 7.7. This flaw allows for a denial-of-service (DoS) condition that can crash firewalls without requiring user authentication. A proof-of-concept exploit for this vulnerability is already available, raising concerns about its potential impact on organizations using these systems. Companies utilizing GlobalProtect PAN-OS software should promptly apply the security updates released by Palo Alto to safeguard their networks. Failure to address this vulnerability could leave systems open to disruptions, affecting overall network availability.

Jan 15, 2026

China bans U.S. and Israeli cybersecurity software over security concerns

Security Affairs

China has ordered domestic companies to cease using cybersecurity software from over a dozen U.S. and Israeli firms due to concerns about national security. This move comes amid escalating tensions between China and the U.S. regarding technology and trade, particularly in the semiconductor sector. The ban affects various cybersecurity solutions that many Chinese companies rely on to protect their networks and data. By restricting these foreign products, China aims to bolster its own cybersecurity infrastructure and reduce dependency on foreign technology. This decision could have significant implications for international cybersecurity firms and may lead to further divisions in the global tech landscape.

Jan 15, 2026

Microsoft disrupts massive RedVDS cybercrime virtual desktop service

BleepingComputer

Microsoft has successfully disrupted RedVDS, a significant cybercrime platform that has been linked to approximately $40 million in losses reported in the U.S. since March 2025. The platform was known for offering a virtual desktop service that criminals used to conduct various illegal activities. This disruption is a major step in combating cybercrime, as it not only targets the infrastructure used by attackers but also aims to deter future criminal operations. The impact of RedVDS has been felt widely, affecting numerous victims who have suffered financial losses due to the platform's activities. By taking action against RedVDS, Microsoft is contributing to a broader effort to enhance cybersecurity and protect individuals and businesses from ongoing threats.

Jan 15, 2026