The South Korean government convened an extraordinary ministerial summit on November 30, a public holiday, to address the extensive security breach at the e-commerce firm, Coupang (CPNG), Chosun Daily reports. This meeting, held at the Government Complex Seoul, saw the attendance of top officials, including the Deputy Prime Minister and Minister of Science and ICT, the head of the Office for Government Policy Coordination, and the Chairperson of the Personal Information Protection Commission (PIPC).

This incident is particularly alarming because Coupang is one of South Korea's dominant online retailers, meaning this massive data theft affects a substantial portion of the nation's consuming public, necessitating an immediate and authoritative state response.

Following Coupang’s late-night announcement on November 29 of the massive data loss, authorities immediately declared a thorough inquiry. The Ministry of Science and ICT confirmed that their on-site inspections began following initial reports from Coupang on November 19 and November 20. Investigators verified that threat actors leveraged authentication flaws in the company’s systems to illicitly extract data for more than 30mn customer accounts, including names, email addresses, and delivery contact details. This suggests that the attackers bypassed standard login protocols by exploiting server vulnerabilities.

To date, no malicious code has been found on the servers. A joint public-private taskforce was mobilised on November 30 to investigate all possibilities, including attacks by sophisticated, possibly state-aligned, hacking entities. The PIPC’s focus is to determine if Coupang neglected its mandatory security obligations, such as proper access control and encryption. The head of the Ministry of Science and ICT's Network Policy Office noted the complexity of identifying the attack source, acknowledging that past breaches have involved insiders or stolen credentials. The government stressed that financial accounts were supposedly safe, but cautioned the public to await definitive findings.

The Deputy Prime Minister issued an apology for the breach at a platform relied upon by the populace, warning citizens to remain vigilant against phishing attempts. Coupang’s representative apologised to its customers and committed to full cooperation with the investigation. The government initiated a three-month period of reinforced monitoring on November 30 for stolen data distribution, including on the dark web.