Key Takeaways
- South Korean e-commerce giant Coupang disclosed at the end of November 2025 a data breach affecting 33.7 million customer accounts
- Exposed data included names, email addresses, phone numbers, shipping addresses, and partial order histories
- Coupang said no payment card data or login credentials were exposed
- The breach scale — comparable to Tokopedia's 91M breach in 2020 — illustrates the systemic risk of centralised e-commerce databases
- ASEAN e-commerce platforms including Shopee, Lazada, and Tokopedia operate databases of comparable scale and sensitivity
The Facts
South Korea's Coupang — often described as South Korea's Amazon — disclosed at the end of November 2025 that a data breach had compromised 33.7 million customer accounts. It first detected unauthorised access on 18 November, initially tied to about 4,500 accounts. The exposed dataset included names, email addresses, phone numbers, shipping addresses, and certain order histories. The company confirmed no payment card or financial data was affected.
33.7 million records places this among the largest e-commerce breaches reported in East and Southeast Asia — more than half of South Korea's population.
The Coupang breach is instructive for ASEAN e-commerce operators not because of Coupang's specific geography, but because of the structural parallels. Shopee, Lazada, Tokopedia, Bukalapak, and TikTok Shop collectively hold personal data at comparable or larger scales across Indonesia, Malaysia, Thailand, Vietnam, and Singapore. The database architectures, authentication systems, and data handling patterns that created Coupang's exposure are not unique to South Korea.
Technical Deep-Dive
Large e-commerce database breaches typically originate through one of three vectors: web application vulnerabilities in customer-facing systems (allowing direct database access from the internet), compromised internal credentials enabling access from inside the network, or third-party vendor compromise giving attackers access through a supplier's connection to the target's systems.
Centralised customer databases — where 33.7 million records of names, addresses, and phone numbers are stored in a queryable format accessible to customer service systems — represent enormous single-point risk. The data model required for e-commerce operations (searching and accessing customer records quickly) is inherently in tension with the data minimisation principles that limit breach exposure.
Tokenisation (replacing personal identifiers with non-sensitive tokens where possible), column-level encryption (encrypting sensitive fields in databases rather than just the database connection), and strict access logging on customer data queries are the technical controls that limit breach impact when initial access is achieved.
The ASEAN Perspective
For ASEAN e-commerce consumers — the majority of whom transact across multiple platforms — the Coupang breach is a reminder that personal data shared for shopping convenience accumulates across dozens of platforms. A name, phone number, and shipping address combination exposed across multiple platform breaches enables sophisticated targeted social engineering even without financial data.
Indonesia's PDP Law, Singapore's PDPA, Thailand's PDPA, and Malaysia's PDPA all impose breach notification requirements on e-commerce operators handling consumer personal data in those jurisdictions. Platform operators need to understand their data breach notification obligations under each country's framework before an incident occurs — not during one.
RECATOOLS Verdict
33.7 million records is an almost incomprehensible scale for a single breach. It represents the concentration of personal data that modern e-commerce operations require, and the proportional risk that concentration creates. ASEAN e-commerce operators should view the Coupang breach as a mirror, not a distant news item.
Sources
- CSIS Significant Cyber Incidents Timeline December 2025
- Data Breaches Digest December 2025
FAQ
What data was exposed in the Coupang breach? Names, email addresses, phone numbers, shipping addresses, and partial order histories for 33.7 million accounts. No payment card or financial data was confirmed affected.
Is Coupang available in ASEAN? Coupang is primarily a South Korean platform, though it has international operations. The breach is relevant to ASEAN as a case study for comparable regional platforms.
What should affected Coupang users do? Monitor for phishing targeting your name and address combination, change the Coupang account password, and be alert for phone calls using accurate personal details.
Which ASEAN e-commerce platforms hold comparable data volumes? Shopee, Lazada, Tokopedia, TikTok Shop, and Bukalapak collectively hold personal data for hundreds of millions of ASEAN consumers at scales comparable to Coupang.
What are ASEAN platforms' breach notification obligations? Breach notification timelines vary: Singapore PDPA requires notification within 3 days of determining a notifiable breach; Malaysia within 72 hours; Indonesia's PDP Law has similar provisions.
Correction, 18 October 2026: An earlier version said the breach was reported in December 2025; Coupang disclosed it at the end of November 2025, after first detecting unauthorised access on 18 November. An unverified description of how an incident tracker ranked the breach has been removed.
View author profile → · Editorial policy
