Coupang breach shows how cloud identity risk can persist for months

At a glance

What this is: This is an analysis of the Coupang breach and the identity governance gap it exposes in cloud environments, especially when unauthorized access can persist for months before detection.

Why it matters: It matters because IAM, IGA, PAM, and NHI teams all have to account for access paths that remain valid long after they should have been closed or revalidated.

By the numbers:

• Coupang said the breach affected 33.7 million customer accounts.
• Coupang identified unauthorized access on November 18, 2025, but said the activity dated back to June 24, 2025.

👉 Read Unosecur's analysis of the Coupang breach and cloud identity risk

Context

Cloud identity risk describes the way access, permissions, and authentication paths can become the real attack surface in a cloud environment. In the Coupang case, the key governance problem is not just exposure of customer data, but the fact that unauthorized access appears to have persisted long enough to create a large blast radius before it was discovered.

The article does not identify the attack method, so the governance lesson is structural rather than forensic. When a cloud programme treats identity as a provisioning task instead of a continuously monitored control boundary, dormant, excessive, or misplaced access can remain available long after the original approval context has disappeared.

That makes this a cloud identity governance problem first and a breach story second. The confirmed facts fit the pattern of access paths outliving the controls that were supposed to contain them.

Key questions

Q: What breaks when cloud identity access is not revoked quickly after a role change or departure?

A: The access path can outlive the business relationship that justified it, which means an apparently valid account or token may still reach sensitive data long after it should have been closed. That creates a long exposure window where detection becomes harder and accountability weaker, especially in cloud environments with overlapping human and non-human access.

Q: Why does delayed identity revocation increase the impact of cloud breaches?

A: Because the longer access remains valid, the more time an attacker has to browse, collect, and quietly extract data without needing fresh compromise. In cloud estates, delayed revocation turns access control into a time-limited containment problem, and every extra day can enlarge the blast radius of the incident.

Q: What are the signs that cloud access governance is failing after an identity breach?

A: Cloud access governance is failing when teams cannot quickly tell who had access, what was approved, and which resources were reachable at the time of compromise. Long delays in confirming scope, excessive standing privileges, and weak visibility into approvals are all warning signs. If incident response depends on manual detective work, access control is not sufficiently operational.

Q: How should organisations handle cloud breach response when the attacker method is still unknown?

A: Start by treating the identity path as the incident boundary. Preserve logs, confirm which accounts and tokens were valid during the exposure window, revoke anything suspicious, and map what data those identities could reach. When the method is unknown, access scope and session history are the fastest route to containment.

Technical breakdown

Why cloud identity becomes the control plane

In cloud environments, roles, permissions, tokens, and sessions often matter more than network perimeter assumptions. Once an identity is authorised, it can reach customer data, admin functions, or internal services without needing malware to move laterally in the traditional sense. That makes cloud identity a control plane, not just an authentication layer. If access review, entitlement monitoring, and revocation are delayed, legitimate-looking sessions can continue to operate long after their business purpose has ended.

Practical implication: treat identity telemetry and entitlement drift as primary security data, not admin housekeeping.

Why delayed discovery increases blast radius

The longer unauthorised access remains active, the more time an attacker has to enumerate data, expand their view, and extract information quietly. Cloud incidents often persist because the environment is dynamic, permissions accumulate, and monitoring focuses on alerts rather than entitlement validity. In this kind of exposure, the security failure is not only initial access, but the absence of a tight revocation and verification loop that would shorten the useful lifetime of the access path.

Practical implication: align revocation, detection, and review cycles to the shortest plausible access window.

Why offboarding is an identity control, not an HR task

Offboarding is where identity governance proves whether access is actually tied to current need. If permissions, keys, or delegated access survive a role change, departure, or vendor transition, they remain usable even when the original relationship is over. In cloud estates this includes human accounts, service accounts, and API-linked access. The control weakness is not simply slow paperwork. It is failure to make offboarding an enforceable revocation event across the identity stack.

Practical implication: make revocation deterministic across human and non-human accounts when a relationship ends.

Threat narrative

Attacker objective: The apparent objective was persistent access to customer data at scale rather than immediate destructive impact.

1. Entry likely occurred through an identity-based path because Coupang said it could not yet identify the method, but confirmed that unauthorized access began on June 24, 2025.
2. Credential or session abuse then appears to have sustained access over time, since the company did not detect the activity until November 18, 2025.
3. The impact was prolonged exposure of customer information, including names, phone numbers, email addresses, physical addresses, and order-related information.

Breaches seen in the wild

• Coupang Signing Key Breach: Unrevoked signing key credentials expose 33.7 million records after employee offboarding failure at Coupang.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Cloud identity risk persists when organisations treat access as a setup task rather than an active control boundary. Coupang’s disclosure shows how long-lived unauthorized access can create large-scale exposure even when the attacker method is unknown. In cloud environments, entitlement drift, delayed revocation, and limited visibility are not edge cases. They are the conditions under which identity-first compromise becomes durable. The practitioner conclusion is that cloud identity governance must be operational, not episodic.

Offboarding failure is a governance gap, not a paperwork gap. The breach pattern aligns with a broader reality: access that should have been removed often survives longer than the business relationship that justified it. That is especially dangerous in cloud estates where human and non-human access paths overlap. The named concept here is revocation lag, the period in which access remains active after the need for it has ended. The practitioner conclusion is that revocation timing is itself a security metric.

Identity visibility without entitlement validation creates a false sense of control. Knowing that an account exists is not the same as knowing whether it should still have access. This incident reinforces the distinction between inventory and governance. A modern identity programme must continuously answer whether the permission is still justified, whether the session is still legitimate, and whether the path can still be used. The practitioner conclusion is that access assurance has to move from static records to live validation.

Cloud breach handling must assume the access path is the primary incident, not a side effect. When data exposure follows persistent unauthorized access, the real failure is usually not the absence of a single control but the accumulation of small governance misses across provisioning, review, and termination. That is why NHI governance, IAM review, and PAM oversight increasingly converge in cloud incidents. The practitioner conclusion is that cloud exposure now demands unified identity governance across human and non-human access.

The Coupang case shows how prolonged access breaks the assumption that detection will arrive before meaningful harm. Security programmes often presume they will see enough warning to intervene, but cloud identity abuse can remain quiet until after the data is already exposed. The practitioner conclusion is that organisations need to govern access duration as aggressively as access scope.

From our research library:

• Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to the Ultimate Guide to NHIs.
• Read next: NHI Lifecycle Management Guide

What this signals

Revocation lag: Cloud programmes often measure whether access was granted, but not whether it was removed quickly enough to matter. When identity controls lag behind operational change, the security boundary shifts from permission management to exposure duration, and that is where many cloud breaches become expensive.

The practical signal is simple: if teams cannot show near-real-time termination of human and non-human access, they are relying on detection after the fact rather than governance before the fact.

For practitioners

• Enforce deterministic offboarding Tie every account, token, key, and delegated access path to an explicit termination event so revocation cannot wait on manual cleanup.
• Shorten identity review cycles Reassess granted permissions on a cadence that matches cloud change velocity, especially for customer-data environments and privileged access paths.
• Track stale and dormant access paths Continuously identify accounts and credentials that remain active after their business purpose has ended, then verify whether they are still justified.
• Separate identity inventory from entitlement validation Maintain a live view of who or what exists, but add an additional check that confirms the access is still needed and still in scope.
• Unify human and non-human offboarding Apply the same termination logic to employee, contractor, service account, and API access so one revocation process closes all related paths.

Key takeaways

• The Coupang disclosure is a cloud identity governance case, not only a data breach case, because access appears to have persisted long enough to expose customer information at scale.
• The most relevant evidence is the gap between when unauthorized activity began and when it was detected, which is the kind of window that weak offboarding and poor access visibility create.
• The control lesson is to make revocation and entitlement validation continuous across human and non-human identities, not dependent on periodic cleanup.

Key terms

• Revocation Latency: Revocation latency is the time between a decision to remove access and the point at which that access is actually gone. It is a practical measure of how long stale privilege remains usable after a role change, offboarding, or contract end. Shorter latency means smaller exposure and cleaner audit evidence.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
• Entitlement Verification: Entitlement verification is the process of checking that granted access matches approved policy and that removed access is actually gone. It closes the gap between workflow execution and real system state. Without verification, lifecycle automation can report completion while stale permissions still exist in downstream tools.
• Cloud Identity: A cloud identity is any account, role, token, or credential used to access cloud services and resources. In practice, it includes both human and non-human identities that can authorize actions in infrastructure, applications, or automation pipelines. Governance depends on knowing which identity type is active and what it can do.

What's in the full article

Unosecur's full blog covers the operational detail this post intentionally leaves for the source:

• The article’s breakdown of how the breach fits the broader identity-first cloud risk pattern
• The vendor’s discussion of continuous identity security and how it frames human and non-human identities
• The specific access-risk examples that support its view of over-privileged and dormant cloud access
• The concluding product context around hidden access risk and cloud identity visibility

👉 Unosecur's full post covers the breach timeline, exposed data, and identity-risk framing in more detail

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.