Coupang breach shows why data-layer visibility failed

At a glance

What this is: Coupang’s breach is presented as a prolonged exposure event in which sensitive customer data was accessed at scale without early detection, despite payment data and credentials remaining secure.

Why it matters: It matters because IAM and endpoint controls alone can miss sustained data abuse, so identity practitioners need data-layer monitoring and exfiltration control to contain real exposure.

Context

Large breaches often unfold quietly when sensitive records are accessed over time rather than stolen in one obvious event. This case is about data governance and monitoring, not password compromise, because the exposed material was customer information sitting in backend systems without enough continuous oversight.

That pattern matters to identity and security teams because the control gap sits between access approval and data movement. When systems can read validly but still leak data, the programme needs visibility into how data is queried, exported, and transferred, not just who authenticated.

Key questions

Q: What fails when sensitive data is not monitored at the data layer?

A: The failure is that security teams can still see authenticated access while missing the actual movement of sensitive records. IAM, firewall, and endpoint controls may all look healthy, yet the breach continues because the risk lives in how data is queried, copied, and exported. Data-layer monitoring is what exposes that difference.

Q: Why can prolonged customer data exposure be more damaging than a quick breach?

A: Because long-running exposure increases the chance of discovery by customers, regulators, or threat actors using the data for phishing and fraud. The duration also suggests that detection and response controls were too weak to interrupt the activity early, which worsens both legal and reputational impact.

Q: What are the signs that secrets exfiltration controls are not working well enough?

A: Common warning signs include secrets appearing in commits, pull requests, or build logs, repeated detection of the same credential type, and slow remediation after exposure. Another signal is when teams rely on manual review instead of automated scanning and response. If repositories keep resurfacing with the same sensitive patterns, the control is not keeping pace with development activity.

Q: Should teams prioritise data discovery before stronger alerting?

A: Yes, because alerting is weak when teams do not know where sensitive data lives or which systems move it most often. Discovery and classification create the map that makes monitoring useful, while alerting without that map produces noise instead of containment.

Technical breakdown

Why data-layer visibility fails in prolonged breaches

Data-layer visibility fails when controls observe users and systems but not the sensitive objects they touch. In a breach like this, valid access can persist while the actual risk is in query volume, export behaviour, and movement of records across internal systems. Traditional IAM confirms that a session is allowed, but it does not tell you whether the accessed data matches expected business use. Without classification and activity baselines, security teams only notice the problem after the exposure becomes large enough to surface externally.

Practical implication: Monitor data access patterns directly, not just authentication events.

How exfiltration controls limit blast radius

Data exfiltration prevention works by applying policy to the data itself, rather than relying on perimeter alerts or endpoint compromise signals. That matters when credentials are valid, because the attacker or insider does not need to break authentication to move information out of approved environments. Controls should evaluate destination, volume, and sensitivity before the transfer completes. This is especially relevant in SaaS, cloud storage, and internal toolchains where customer records can be copied through normal-looking workflows.

Practical implication: Block or constrain outbound movement of sensitive records when behaviour diverges from expected use.

Why discovery and classification come before response

Discovery and classification are the foundation of any data-centric programme because you cannot govern what you cannot locate. In practice, customer data often exists in databases, analytics tools, tickets, collaboration platforms, and cloud services, creating blind spots if teams assume the primary production store is the only exposure point. Classification gives monitoring and response systems a target, while discovery keeps that map current as the environment changes. Without that foundation, detection logic is too generic and response arrives too late.

Practical implication: Continuously map where sensitive data lives before trying to detect misuse.

Threat narrative

Attacker objective: The objective was to quietly extract customer information at scale while avoiding detection long enough for the breach to persist for months.

1. Entry occurred through sustained unauthorized access to customer data in backend systems rather than through a visible credential theft event.
2. Credential or account misuse was not the central signal in the article; the key issue was that access remained valid long enough for repeated retrieval of sensitive records.
3. Escalation came from the scale and duration of access, which allowed names, addresses, phone numbers, and order histories to be exposed across an extended period.
4. Impact was large-scale customer data exposure that created phishing, fraud, and trust risks even though payment data and login credentials were not reported as compromised.

Breaches seen in the wild

• DeepSeek database exposure 2025: An unauthenticated DeepSeek ClickHouse database exposed over a million log lines with plaintext chat history and API keys in 2025.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Data-layer visibility is now a primary governance control, not a monitoring luxury. This breach shows that identity and endpoint tools can validate access while still missing the actual exposure path. When customer records are read, copied, or exported in normal-looking workflows, the decisive control is whether the data layer is instrumented with classification and behavioural detection. Practitioners should treat data movement telemetry as part of core security governance.

Continuous oversight beats event-based discovery when access is long-running. The failure mode here is not a single missed alert, but the absence of a control that could see gradual accumulation of risk. That creates what we would call data-plane drift: sensitive records move farther from the expected control boundary while the security programme still assumes the original access model is intact. Teams need to align monitoring to how data actually flows, not how the architecture diagram says it should.

Identity controls remain necessary, but they do not answer the breach question on their own. IAM can tell you who authenticated, yet this case is about what happened after authentication succeeded. That is the boundary where data-centric security, exfiltration policy, and behavioural baselines become essential. The practitioner conclusion is clear: if valid access can still produce silent exposure, the governance model is incomplete.

Regulators and incident responders increasingly care about duration, not just breach existence. A short-lived incident and a months-long exposure create different legal, operational, and reputational consequences. The control gap is not only prevention, but the ability to interrupt abnormal access early enough that the exposure window does not become the story. Practitioners should measure how long sensitive-data abuse can continue before detection.

From our research library:

• Business leaders plan to spend $124 million on average on AI in 2026, and 91% say data security and risk will shape their AI strategy.
• Read next: AI Agent Observability, Audit and Incident Response Guide

What this signals

Data-plane drift: when records move and replicate across backend systems faster than the control model is updated, the organisation loses sight of where exposure can actually occur. That means security programmes need continuous discovery tied to classification, transfer telemetry, and enforcement points rather than periodic reviews.

For identity teams, the key shift is to treat valid access as only one part of the risk picture. If a session can still produce large-scale record movement without tripping response, the programme needs detection and containment at the data layer, not only stronger login controls.

For practitioners

• Map sensitive data across all storage and collaboration systems Build a current inventory of where customer data resides in databases, cloud services, analytics platforms, SaaS tools, and internal workflows. Treat that inventory as a security control, not a documentation exercise.
• Baseline normal data access and export behaviour Define what normal query volumes, export sizes, and transfer destinations look like for each high-value data set so abnormal access becomes measurable rather than subjective.
• Enforce policy-based exfiltration controls Apply controls that inspect data sensitivity and destination before records leave approved environments, especially where valid credentials can still be used to move information out.
• Review detection gaps in prolonged access scenarios Test whether your environment would surface a slow, months-long read-and-copy pattern before customers or regulators do, then tune alerts for duration and volume as well as outright denial.

Key takeaways

• The Coupang breach is a reminder that large-scale exposure can persist even when passwords and payment data are not the primary problem.
• The underlying failure is visibility into how sensitive customer data is queried, transferred, and exfiltrated across backend systems.
• Teams need discovery, classification, and policy-based data controls to shorten the window between normal access and detectable abuse.

Key terms

• Data Centric Security: Data Centric Security protects information itself, rather than relying only on the security of systems that store or move it. It uses controls such as classification, encryption, tokenization, access policies, and usage restrictions so data remains protected wherever it travels, is copied, or is processed across cloud, endpoint, and application environments.
• Data Exfiltration Monitoring: Data exfiltration monitoring is the observation of how sensitive data moves out of an environment through uploads, copy and paste, sync tools, email, and other channels. It helps security teams identify risky transfers early, track lineage, and trigger actions before data leaves controlled boundaries.
• Data Discovery: Data discovery is the process of finding where information lives across cloud, SaaS, endpoints, backups, and analytics systems. In practice, it creates the inventory that makes classification, access decisions, recovery planning, and AI governance possible rather than speculative.
• Data-plane Drift: A governance gap where sensitive data moves farther from the expected control boundary while the security programme still assumes the original access model is intact. It is an operational sign that monitoring, classification, and response are not keeping pace with how data is really used.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. It is designed for practitioners who need to connect access governance with the broader security controls their programmes depend on.