Key Takeaways

  • South Korean e-commerce giant Coupang reported a data breach in December 2025 affecting 33.7 million customer accounts
  • Exposed data included names, email addresses, phone numbers, shipping addresses, and partial order histories
  • No financial data or payment card numbers were confirmed compromised
  • The breach scale — comparable to Tokopedia's 91M breach in 2020 — illustrates the systemic risk of centralised e-commerce databases
  • ASEAN e-commerce platforms including Shopee, Lazada, and Tokopedia operate databases of comparable scale and sensitivity

The Facts

South Korea's Coupang — often described as South Korea's Amazon — reported in December 2025 that a data breach had compromised 33.7 million customer accounts. The exposed dataset included names, email addresses, phone numbers, shipping addresses, and certain order histories. The company confirmed no payment card or financial data was affected.

33.7 million records positions this among the largest e-commerce breaches ever documented in East and Southeast Asia. The CSIS Significant Cyber Incidents timeline documented the breach as one of December 2025's most significant incidents, alongside attacks on French government systems and a major US healthcare network.

The Coupang breach is instructive for ASEAN e-commerce operators not because of Coupang's specific geography, but because of the structural parallels. Shopee, Lazada, Tokopedia, Bukalapak, and TikTok Shop collectively hold personal data at comparable or larger scales across Indonesia, Malaysia, Thailand, Vietnam, and Singapore. The database architectures, authentication systems, and data handling patterns that created Coupang's exposure are not unique to South Korea.

Technical Deep-Dive

Large e-commerce database breaches typically originate through one of three vectors: web application vulnerabilities in customer-facing systems (allowing direct database access from the internet), compromised internal credentials enabling access from inside the network, or third-party vendor compromise giving attackers access through a supplier's connection to the target's systems.

Centralised customer databases — where 33.7 million records of names, addresses, and phone numbers are stored in a queryable format accessible to customer service systems — represent enormous single-point risk. The data model required for e-commerce operations (searching and accessing customer records quickly) is inherently in tension with the data minimisation principles that limit breach exposure.

Tokenisation (replacing personal identifiers with non-sensitive tokens where possible), column-level encryption (encrypting sensitive fields in databases rather than just the database connection), and strict access logging on customer data queries are the technical controls that limit breach impact when initial access is achieved.

The ASEAN Perspective

For ASEAN e-commerce consumers — the majority of whom transact across multiple platforms — the Coupang breach is a reminder that personal data shared for shopping convenience accumulates across dozens of platforms. A name, phone number, and shipping address combination exposed across multiple platform breaches enables sophisticated targeted social engineering even without financial data.

Indonesia's PDP Law, Singapore's PDPA, Thailand's PDPA, and Malaysia's PDPA all impose breach notification requirements on e-commerce operators handling consumer personal data in those jurisdictions. Platform operators need to understand their data breach notification obligations under each country's framework before an incident occurs — not during one.

RECATOOLS Verdict

33.7 million records is an almost incomprehensible scale for a single breach. It represents the concentration of personal data that modern e-commerce operations require, and the proportional risk that concentration creates. ASEAN e-commerce operators should view the Coupang breach as a mirror, not a distant news item.

Sources

  • CSIS Significant Cyber Incidents Timeline December 2025
  • Data Breaches Digest December 2025

FAQ

What data was exposed in the Coupang breach? Names, email addresses, phone numbers, shipping addresses, and partial order histories for 33.7 million accounts. No payment card or financial data was confirmed affected.

Is Coupang available in ASEAN? Coupang is primarily a South Korean platform, though it has international operations. The breach is relevant to ASEAN as a case study for comparable regional platforms.

What should affected Coupang users do? Monitor for phishing targeting your name and address combination, change the Coupang account password, and be alert for phone calls using accurate personal details.

Which ASEAN e-commerce platforms hold comparable data volumes? Shopee, Lazada, Tokopedia, TikTok Shop, and Bukalapak collectively hold personal data for hundreds of millions of ASEAN consumers at scales comparable to Coupang.

What are ASEAN platforms' breach notification obligations? Breach notification timelines vary: Singapore PDPA requires notification within 3 days of determining a notifiable breach; Malaysia within 72 hours; Indonesia's PDP Law has similar provisions.