Coupang Pivots to Passkeys in Taiwan as 33.7M Accounts Exposed in Korea

South Korean e-commerce giant Coupang is deploying passwordless authentication in Taiwan just as it manages a massive data breach in its home market. The incident offers a case study for CISOs on modernizing identity frameworks to mitigate reputational and financial risk.

On November 30, 2025, Coupang confirmed a security incident affecting approximately 33.7 million customer accounts, representing nearly the entirety of its South Korean user base. The breach went undetected for five months. It began on June 24, 2025, and was only identified by the company on November 18.

According to official statements, threat actors exploited unauthorized access tokens to exfiltrate personally identifiable information including full names, phone numbers, email and physical shipping addresses, and specific order histories. Coupang maintains that payment data and login passwords were not compromised. However, the volume of PII exposed creates opportunities for high-fidelity phishing and smishing campaigns. The South Korean government has launched an emergency investigation involving the Ministry of Science and ICT and the National Police Agency to assess compliance with data protection laws.

While managing fallout in Seoul, Coupang is simultaneously fortifying its position in Taiwan, which it views as its “second Korea.” The company has successfully deployed a FIDO-compliant passkey system, allowing Taiwanese users to authenticate via biometrics rather than vulnerable passwords.

Following the rollout, the Taiwanese government officially recognized Coupang as a “Friendly E-Commerce Company,” a certification granted for upholding high standards in consumer protection and safe shopping environments. Coupang Founder and CEO Bom Kim, who has reportedly been focusing efforts on the Taiwanese expansion, is positioning the subsidiary as a leader in secure digital commerce, effectively firewalling the brand’s growth market from its domestic security crisis.

For industry professionals, the dichotomy highlights the urgent obsolescence of legacy credential management. While Coupang’s Korean infrastructure suffered from undetected access likely exacerbated by traditional credential vulnerabilities, its Taiwanese operation is proactively adopting an architecture designed to render such attacks moot. The incident underscores that the transition to passwordless standards like passkeys is not merely a UX upgrade but a fundamental continuity requirement.

Sources: TechRadar, The Korea Herald, TechCrunch

—

By Ali Nassar-Smith