Coupang data breach shows cloud identity risk outlasting controls

At a glance

What this is: This analysis of the Coupang breach argues that prolonged unauthorized access in cloud environments is an identity governance failure, not just an incident response problem.

Why it matters: IAM, IGA, PAM, and NHI teams should treat offboarding, access review, and effective privilege monitoring as continuous controls when cloud access can persist unnoticed.

By the numbers:

• 33.7 million customer accounts were affected by the Coupang breach.

👉 Read Unosecur's analysis of the Coupang breach and cloud identity risk

Context

The Coupang incident is best understood as an identity governance problem in a cloud environment where access can persist after the control plane has lost sight of it. The disclosed exposure involved customer information, while the attack method and attacker identity were not disclosed, which makes governance gaps more important than speculation about the intrusion path.

In practical terms, this is the difference between configured access and effective access. When permissions, sessions, tokens, or offboarding states are not continuously reconciled, unauthorized access can continue long enough to expose large data sets before detection closes the window.

The article frames the issue as a cloud identity risk story because the breach lasted for months and involved customer data rather than infrastructure destruction. That pattern is typical of environments where access governance lags behind operational change.

Key questions

Q: What breaks when teams cannot quickly revoke access to cloud resources during offboarding?

A: When access revocation is slow, former employees or contractors can retain permissions longer than intended across groups, licenses, repositories, and other shared resources. That creates avoidable exposure during the most sensitive transition period in the identity lifecycle. It also undermines audit readiness because access history may show delayed removal rather than immediate, controlled offboarding.

Q: Why do stale cloud permissions increase the impact of a breach?

A: Stale permissions enlarge the set of data and systems reachable from a compromised identity, which increases the blast radius of any unauthorized session. In cloud environments, the problem is not only entry but how much customer data remains accessible once access is established. That makes effective privilege a primary risk variable.

Q: How can security teams know if cloud identity governance is actually working?

A: The clearest signals are fewer unresolved access findings, shorter evidence-collection cycles, lower counts of stale keys, and reduced reliance on manual review. If teams still spend days reconstructing access state, governance is not operating continuously. Effective programmes can show current MFA coverage, role scope, and credential age on demand.

Q: What is the difference between assigned access and effective access in cloud IAM?

A: Assigned access is what appears in policy or directory records, while effective access is what can actually be used right now through roles, sessions, tokens, or delegated permissions. Effective access is the security reality that matters during a breach. Organisations need both views, but only effective access tells them what an attacker could do.

Technical breakdown

How prolonged unauthorized access persists in cloud identity estates

Cloud environments often separate configured permissions from the access that is actually live at runtime. That gap matters because roles, tokens, sessions, and service credentials can remain valid long after the business context that justified them has changed. In practice, a system can still authorize access even when the owning account has moved teams, left the organisation, or changed risk profile. That is why identity governance has to track effective access, not just directory records. The Coupang disclosure fits this pattern: the important question is not only how the access began, but why it could continue for months without being revoked or detected.

Practical implication: continuously reconcile active access against business ownership and remove privileges that no longer match current need.

Why offboarding gaps turn into long-tail exposure

Offboarding is not just account closure. In cloud and SaaS estates, it also includes revoking keys, tokens, delegated access, and any standing authorizations that survive a role change or departure. If those steps are incomplete, access can outlive employment, vendor relationships, or internal reassignments. That creates a long-tail exposure window in which credentials remain usable even though governance has moved on. The source article’s discussion of offboarding and insider-related risk reinforces this point: the control failure is not absence of policy, but failure to terminate access with operational certainty.

Practical implication: tie joiner-mover-leaver workflows to credential and session revocation, not just directory disablement.

Identity visibility has to cover human and non-human access

Modern cloud estates are not governed by human accounts alone. API keys, tokens, service accounts, and other non-human identities often carry the access that matters most, especially in systems with customer data or automation-heavy operations. When those identities are not inventoried, monitored, and recertified, the organisation loses sight of where effective privilege actually sits. That is why the identity surface is broader than workforce IAM. In this case, the article’s emphasis on broad cloud identity risk points to a structural issue: if teams cannot see both human and non-human access paths, they cannot reliably constrain the blast radius of a compromise.

Practical implication: inventory non-human identities alongside workforce accounts and review their permissions on the same governance cycle.

Threat narrative

Attacker objective: The apparent objective was to maintain access to customer data at scale without being detected for as long as possible.

1. Entry appears to have occurred through unauthorized access to customer information in Coupang's cloud environment, but the article does not disclose the exact initial vector.
2. The access persisted from June 24, 2025 until detection on November 18, 2025, which indicates a prolonged period of active credential or session abuse.
3. The impact was sustained exposure of customer names, phone numbers, email addresses, physical addresses, and order-related information across 33.7 million accounts.

Breaches seen in the wild

• Coupang Signing Key Breach: Unrevoked signing key credentials expose 33.7 million records after employee offboarding failure at Coupang.
• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Cloud identity risk is now a control-plane problem, not a perimeter problem. The Coupang incident shows that once authorization exists, cloud systems can preserve access long enough for exposure to become operationally significant. The issue is not just intrusion prevention, but whether effective access is continuously governed after issuance. Practitioners should treat runtime privilege as the security boundary.

Offboarding failure is the most visible symptom of deeper lifecycle debt. When access persists for months, the organisation is not simply late on revocation. It has lost control over how identity state changes propagate across accounts, sessions, tokens, and delegated access. That is a lifecycle governance failure that spans IAM, IGA, and PAM operating models. The practical conclusion is that offboarding must be measured by actual access disappearance, not process completion.

Identity blast radius is the right concept for cloud breach analysis. The article’s confirmed facts point to a large data exposure window once access was present. That means the question is not only who got in, but how much reachable data sat behind that access path. Blast radius, not just account compromise, should drive risk prioritisation and control design.

Non-human identity governance is part of the same breach class. Cloud incidents rarely stay confined to named user accounts. Tokens, service identities, and delegated credentials can extend access silently across environments, especially when offboarding and review processes focus on employees alone. Organisations that only govern human accounts are leaving a structural gap in the identity control plane.

From our research library:

• Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to the Ultimate Guide to NHIs.
• Read next: NHI Lifecycle Management Guide

What this signals

Identity programmes built around provisioning alone will keep missing the real failure mode: access that remains valid after the business reason for it has disappeared. The operational test is whether teams can prove that live access, not just directory state, has been removed.

Identity blast radius: Once an account or credential is compromised, the real question becomes how much customer or operational data sits behind that access path. Practitioners should use that concept to prioritise reviews of the highest-reach identities first.

Offboarding needs to be measured as a control outcome, not a workflow completion. If keys, tokens, sessions, and delegated access are still active after a role change or departure, the environment is already carrying avoidable exposure.

For practitioners

• Map effective cloud access, not just assigned roles Reconcile live entitlements, sessions, tokens, and delegated permissions against the business owner for each critical cloud account. Prioritise accounts that can reach customer data or administrative functions.
• Tie offboarding to credential and session revocation Require revocation of keys, tokens, and active sessions as part of every leaver or mover workflow, including contractor and vendor offboarding. Do not treat directory disablement as sufficient closure.
• Inventory non-human identities with the same rigor as workforce accounts Create a single inventory for service accounts, API keys, certificates, and automation credentials so review cadence, ownership, and risk scoring apply across all identity types.
• Shorten the time between access change and enforcement Measure how long access continues after a role change, termination, or vendor disengagement, then set a target that reflects the highest-value data paths rather than the easiest administrative process.

Key takeaways

• The Coupang breach reinforces that cloud identity failures can create extended exposure windows even when the intrusion method is not publicly disclosed.
• The scale of the incident and the confirmed months-long access window show why identity governance must track effective access, not just provisioning records.
• Teams that want to reduce similar risk need to connect offboarding, privilege review, and non-human identity inventory to the same operational control loop.

Key terms

• Effective Access: The actual permissions an identity can exercise after inheritance, nested groups, delegation, and object-level controls are evaluated. In Active Directory, effective access is more useful than direct membership because it reveals the true operational reach of a service account.
• Off-boarding: Off-boarding is the process of removing a departing user’s access, credentials, and related entitlements from the environment. In mature IAM programmes, it also includes reviewing sessions, shared secrets, delegated roles, and linked non-human identities so that exit events do not leave behind hidden access paths.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
• Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.

What's in the full article

Unosecur's full blog post covers the operational detail this analysis intentionally leaves for the source:

• The article's incident timeline and disclosure details from Coupang's public notice
• The identity-risk interpretation the vendor draws from cloud access persistence and offboarding gaps
• The specific industry figures it cites on offboarding failures and insider-related exposure
• The vendor's walkthrough of how continuous identity security is positioned against stale cloud access

👉 Unosecur's full blog post covers the disclosure timeline, identity-risk framing, and cloud governance implications.

Deepen your knowledge

NHI governance, human identity lifecycle, and workload identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM or identity governance programme, it is worth exploring.