A significant data breach occurred at Coupang, a major online shopping platform in Asia, in December 2025. This incident has resulted in millions of customers’ data being accessed with unauthorized access to names, contact numbers, details of card payments and order history. As industrial institutions continue to migrate towards a cloud-native application platform along with high-cycle DevOps methodologies, incidents like this demonstrate one critical fact; security should never be an afterthought.
Coupang serves as a case study for developers, cloud
engineers and security personnel on how things could be executed successfully.
This article will examine what went wrong during this incident, how could
attackers have taken advantage of vulnerabilities within Coupang’s systems, and
how with compliant security methodologies such activities could be avoided in
the future.
What Happened During the Coupang Breach?
According to public information and cybersecurity reports,
attackers stole developer access keys for Coupang's cloud account through compromised
internal automation scripts. Using these keys, attackers accessed cloud
environments within Coupang, moved through different areas of the cloud, and
ultimately took user data out of the cloud without triggering alarms.
Key Failures That Led to the Breach
1. Developers' Secrets Were Exposed:
The problems stemmed from the use of hardcoded developer access keys, which were found in scripts, CI/CD pipelines, and internal automation tools. Where many companies use automation to test and build their code, the keys often end up hardcoded in the scripts. Attackers simply look through repositories for inadvertently published credentials. Once they have the credentials, they also have the same privileges as a legitimate developer and can carry out the same actions.
2. Insufficiently Restricted Access Keys:
The stolen access key was used for a customer account with more permissions than necessary, violating the principle of least privilege. Instead of limiting the permissions of an engineer’s role to the least amount needed for a particular job function, the permissions also allowed the engineer to access sensitive databases and internal services.
3. Poor Logging and Late Breach Detection.
.png)
As indicated in several of the OWASP risk categories, the
actions of the attackers were facilitated by poor logging and lack of
monitoring. The attackers were able to access a large number of resources for
multiple days prior to being detected.
While CloudTrail does generate logs for all authorization
events, alerting could have been configured to notify organizations of the
following abnormal activity:
- unusual authentication requests
- unauthorized generation of multiple API calls outside of an organization’s typical working hours
- abnormally high volume of data downloaded from an organization to a third party
- unauthorized queries to a database
4. Absence of Segmentation in Networks
With a centrally located network, lateral movement was a clear advantage to an attacker upon gaining access to corporate infrastructure; therefore, once an attacker breached one environment, they could easily navigate to other environments. A properly segmented network will limit the lateral movement of attackers by segmenting (isolating) workloads according to their sensitivity.
How You Would Avoid a Breach Like This?
1. Never hardcode secrets
- Utilize secure secret management systems, such as:
- AWS Secrets Manager
- HashiCorp Vault
- GitHub Secrets
Automatically rotate Keys and prevent developers from hardcoding credentials into code repositories.
2. Implement the principle of least privilege Access
All access should be tied to roles that are explicitly defined and regularly audited. Automating checks of IAM Policy through automation allows for the identification of over-privileged accounts quickly.
3. Set up Real-Time Security Alerts
- Use SIEM, Cloud-Native Monitoring tools and automated alerts for:
- unusual API calls
- unauthorized login attempts
- large database query events
- privilege escalation events.
Without real-time notifications, the most sophisticated logs are useless.
4. Make sure there are clear Segments in Networks
- There needs to be identified segments of networks, such as:
- Production
- Staging
- Development.
If any one of these environments is compromised, an attacker should not be able to gain access to any other environment.
5. Assure that security is part of every stage of the
Development Process
- Security must be built into the Development Process, rather than focusing solely on production.
- Security must be integrated within the CI/CD pipeline and include:
- SAST
- DAST
- Scanning Infrastructure as Code Security
- Secrets Scanning During Code Commits
- Dependency Vulnerability Scans
Conclusion:
The 2025 Coupang data breach highlights to companies that are scaled up, how a
single simple mistake like storing keys in automated scripts can lead to an
enormous compromise when combined with lack of monitoring and over-privileged
users.
At the same time, this incident demonstrates how
organizations can prevent similar breaches by improving secret management,
enforcing greater access controls, enhancing their monitoring and incorporating
security into their DevOps processes.
Operationally, security is not a technical requirement;
rather, security must be considered operationally in today’s ever-changing
world of cyber threats.
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)