The government’s introduction of the concept of “inquiry” in relation to Coupang’s personal data breach has intensified confusion surrounding the issue.
Officials have stated that the act of inquiry itself should be considered a form of breach, distinguishing it from the 33.67 million instances of data leakage. They’ve also indicated that to understand the full scale of the breach, we must await the announcement from the Personal Information Protection Commission, raising further questions.
Government reports: 33.67 million instances of leakage, 150 million inquiries… Inquiry classified as breach
On the 10th, during a briefing on the Coupang security breach investigation results, Choi Woo-hyuk, Director of the Information Protection and Network Policy Bureau at the Ministry of Science and ICT, confirmed that user information, including names and emails, was leaked in 33.67 million cases from the information modification page.
Choi also verified that the delivery address list page, containing names, phone numbers, delivery addresses, and de-identified shared entrance passwords (using special characters), was accessed 148.05 million times, resulting in information leakage.
He further noted that the modification page for the delivery address list, which includes shared entrance passwords, was accessed 50,000 times, while the order list page containing recently ordered items was viewed 100,000 times.
The joint investigation team firmly asserted that inquiry equates to leakage. Lee Dong-geun, deputy head of the team, explained, “The moment an inquiry occurs, the information moves beyond our control. That’s why we’re reporting 140 million instances of leakage through inquiries. Since third parties accessed personal information stored in Coupang’s system, it’s no longer under their control.”
This announcement appears to align with standard personal information protection guidelines, which define a data breach as personal information escaping the management and control of the data processor, reaching a state where third parties can access its contents.
This raises questions about whether the 150 million inquiry counts should be added to the 33.67 million instances described as leakage, or if all information from the delivery address list page, accessed 150 million times, should be included in the total breach scale. The current results from the joint investigation team don’t provide clarity on this matter.
The team stated that the Personal Information Protection Commission will finalize and announce the scale of the personal information breach.
33.67 million instances, no external transmission… Was Coupang’s ‘self-investigation’ accurate?
Some critics question whether the government introduced the concept of “inquiry,” which wasn’t mentioned in previous investigations like the SK Telecom SIM card information breach or the KT unauthorized small payment incident, to potentially inflate the scale of the issue.
Regarding Coupang’s claim that the perpetrator stored and deleted 3,000 pieces of personal information, the joint investigation team provided an ambiguous response, stating, “We are verifying and receiving materials, but that’s just part of the investigation process. It seems unnecessary to confirm whether the current figures are accurate or not.”
Industry insiders are focusing on the joint investigation team’s announcement that the scale of leakage is 33.67 million instances, with no records of actual external transmission. The team also emphasized that they haven’t confirmed any secondary damage or payment-related harm.
Previously, Coupang’s own investigation reported that 33.7 million accounts were compromised, stating, “This information has never been transmitted externally, and there has been no access to payment information or login-related data.”
An industry source commented, “The fact that the government’s meticulous two-month examination of Coupang’s servers yielded results similar to Coupang’s own investigation suggests that Coupang’s initial findings were accurate.”
Most Commented