One unrevoked key can expose millions through data access

At a glance

What this is: This is an analysis of the Coupang breach showing how one unrevoked credential and weak access controls enabled prolonged customer data exposure at massive scale.

Why it matters: It matters because IAM, PAM and data security teams have to correlate credential state with data reach and abnormal access if they want to limit blast radius and prove containment.

By the numbers:

• The breach affected 37.5 million people, including 33.22 million Coupang users and about 4.33 million third-party data subjects.
• South Korea's PIPC fined Coupang 624.68 billion won, approximately $409 million, in what it said was the largest data-breach penalty ever imposed by a Korean regulator.

Context

Coupang’s breach is a credential-lifecycle and data-access governance failure, not just a single key-management mistake. When a departed identity remains trusted, the core question becomes what sensitive data that trust can still reach, how long the access goes unnoticed, and whether the organisation can reconstruct the affected estate after the fact.

For IAM, PAM and NHI programmes, the incident shows why authentication state cannot be managed in isolation from data sensitivity and activity telemetry. The same access path can look normal at the identity layer while still enabling prolonged exposure of customer records, which is why blast radius must be measured in data terms, not only in privileges.

Key questions

Q: What breaks when a departed identity still has valid access to sensitive data?

A: The access model breaks because offboarding has not fully removed the trust relationship that lets the identity reach production data. The result is not just residual permission but a hidden exposure window, where normal-looking authentication can continue until someone correlates the credential, the data touched and the business justification for keeping access alive.

Q: Why do valid user credentials create such a large breach risk in Windows environments?

A: Because a successful logon often looks indistinguishable from legitimate work unless the surrounding session behaviour is monitored. Once the attacker authenticates, they can reuse normal identity paths to reach servers, files, and data without triggering classic perimeter alerts. The credential becomes the attack vehicle.

Q: How can security teams tell when a trusted integration is being abused?

A: Look for drift from the approved behavioural baseline. Unexpected source infrastructure, new user agents, API version changes, schema discovery, and unusually large QueryMore pagination bursts are all strong signals that a trusted integration is no longer acting normally. Those signals should be monitored as identity events, not just application logs.

Q: Who should be accountable for revoking stale access to customer data?

A: Identity, platform and data governance owners should share accountability, because the failure spans credential lifecycle, application access and data protection. If any one team owns the problem alone, the organisation usually ends up with a gap between offboarding, revocation and data-risk review that attackers or insiders can exploit.

Technical breakdown

Why a valid signing key can still be dangerous

A signing key lets a system issue or validate trusted tokens, so compromise or retention of that key can preserve access even after the original user departs. The security boundary is not the token alone but the combination of signature validity, claim checking, expiry, audience, scope and downstream authorisation. If any of those controls is weak, a credential that looks legitimate at authentication time can still reach sensitive data. That is why credential state and authorisation state have to be governed as one control chain, not separate problems.

Practical implication: Treat signing keys and their downstream authorisation paths as a single governed trust surface.

Why data-aware access control changes the blast radius

Traditional access reviews ask who can reach a system. Data-aware governance asks what kinds of records sit behind that system and how much damage a misused credential could cause. That matters because a stale credential against a high-volume customer dataset is materially different from the same credential in a low-sensitivity environment. The relevant control is not only least privilege, but least privilege with sensitivity context, so remediation priority reflects the value and exposure of the data, not just the size of the entitlement list.

Practical implication: Prioritise revocation and review by data sensitivity and reachable blast radius.

How correlated telemetry turns hidden access into an observable pattern

A valid credential can blend into routine traffic unless identity state, access volume, source context and data sensitivity are analysed together. Single-plane logs often show a permitted request, while the cross-plane pattern reveals abnormal consumption of sensitive records from an unexpected source over an extended window. That is the difference between activity logging and access intelligence. For NHI and machine-identity governance, the operational lesson is that detection has to judge whether the access still makes business sense, not just whether it was syntactically allowed.

Practical implication: Correlate identity, source and data signals to surface abnormal use of trusted access.

Threat narrative

Attacker objective: The objective was sustained access to high-value customer data through trusted credentials that still appeared valid to production systems.

1. Entry began with a departed engineer’s credential and authentication signing key remaining valid after termination, which preserved a trusted path into production systems.
2. Credential access then enabled repeated reads of customer data without triggering immediate containment, because the access looked legitimate at the authentication layer.
3. Impact followed as sensitive customer information, including names, contact details, delivery addresses and apartment entry codes, was exposed over roughly six months.

Breaches seen in the wild

• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
• Spain's first AI agent data breach 2026: Spain's AEPD logged its first breach notification attributed to an attacker's AI agent, which altered personal data and accessed invoices.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Credential lifecycle is a data security control, not just an IAM housekeeping task. The Coupang case shows that a valid credential can be the mechanism of exposure long after an employee departs, which means offboarding, key revocation and ownership tracking are inseparable from data protection. Organisations that treat revocation as administrative cleanup miss the real issue: stale trust can persist until it is exercised against sensitive data. Practitioners should govern credential retirement as an active risk-reduction control.

Data-aware governance is the missing layer in many access programmes. The breach was not only about who had access, but about what that access could reach and how much of it could be consumed before anyone noticed. That is the central gap in many identity programmes: they can certify entitlements without understanding blast radius. Data access intelligence: the capability to correlate identities, entitlements, source context and sensitive-data location so misuse becomes measurable. Practitioners should use it to rank access by exposure, not by role alone.

This incident illustrates a standing-trust failure mode that is especially relevant to non-human identities as well as people. When an identity, service account or token remains trusted beyond its intended life, the organisation inherits a hidden access window that conventional reviews may never see. That is the same governance problem now appearing in AI agents, API keys and workload credentials, where lifecycle control and sensitivity context must move together. Practitioners should assume that any trusted identity can become a long-duration exposure path if its lifecycle is not tightly bound to business need.

Blast-radius control is now a first-class security objective. The core question is no longer whether a credential exists, but how far it can travel across data estates before detection and containment. That reframes identity governance from list management to exposure management, especially where regulated personal data is involved. Practitioners should measure controls by how much sensitive data they prevent a compromised identity from reaching.

From our research library:

• Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems. Organisations failing to scope AI access properly are 4.5x more likely to experience a security incident, according to the 2026 Infrastructure Identity Survey.
• 62% of organisations are at least experimenting with AI agents, but only 23% have scaled one into a single business function, according to McKinsey's 2025 State of AI survey.
• Read next: AI Agent Observability, Audit and Incident Response Guide

What this signals

Data access intelligence is becoming a control plane, not a reporting layer. The Coupang case shows why organisations need to know not only who is authenticated, but which datasets that identity can touch and whether the resulting pattern still makes business sense. Access reviews that ignore data context will continue to miss long-duration exposure windows, especially where credentials remain valid after role change or departure.

Credential lifecycle and data sensitivity now have to be evaluated together. In practice, that means treating identity state, source context and sensitive-data consumption as a single governance problem rather than three separate dashboards. When a valid credential can still reach regulated or high-value data, the programme risk is no longer theoretical, and blast radius becomes the metric that matters.

Blast-radius governance: the discipline of ranking identities by the amount and sensitivity of data they can reach, then using that ranking to drive revocation and monitoring priorities. That approach is the only reliable way to keep stale trust from becoming silent exposure in large data estates.

For practitioners

• Tighten offboarding and revocation workflows Revoke signing keys, tokens, service credentials and application access as a single offboarding event, not as separate tickets with different owners.
• Map data reach to every privileged credential Identify which customer, regulated or high-value datasets each credential can reach, then prioritise review where the reachable data creates the largest blast radius.
• Correlate identity and access telemetry Join authentication logs, source location, token issuance and sensitive-data consumption so repeated access against the same records becomes visible as a pattern.
• Separate access validation from data sensitivity Treat a permitted login as only the first control step, then require downstream checks on object ownership, scope and data classification before high-risk reads complete.

Key takeaways

• A departed identity with still-valid access can turn ordinary authentication into prolonged exposure of customer data if downstream controls are weak.
• The breach affected 37.5 million people and led to a $409 million Korean fine, showing how access failures quickly become regulatory and reputational events.
• Organisations need identity, telemetry and data sensitivity in one governance model, or they will keep missing the difference between permitted access and safe access.

Key terms

• Credential Lifecycle: Credential lifecycle is the process of issuing, rotating, expiring, and revoking secrets, certificates, and tokens across their usable life. For non-human identities, lifecycle discipline is the core control that separates temporary access from persistent exposure.
• Blast Radius: The potential scope of damage if a specific credential or identity is compromised. Identities with broad permissions have a larger blast radius and represent a higher priority for least-privilege enforcement and security controls.
• Data Access Intelligence: Data access intelligence is the practice of connecting identity, entitlement, activity, and data sensitivity so teams can see what a credential can actually reach. It turns access review into blast-radius analysis and helps security and privacy teams prioritise the records and systems that matter most.
• Authentication Signing Key: A private cryptographic secret used to create or validate signed authentication tokens. If the key is retained, leaked or not revoked when ownership changes, downstream systems may continue to trust requests that should no longer be considered legitimate.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security and secrets management for practitioners who need to govern access at scale. It helps security and identity teams connect lifecycle control to the broader security programme they run every day.