Topic starter
24/06/2026 8:44 pm
TL;DR: Unosecur says Coupang disclosed unauthorized access affecting 33.7 million customer accounts, with activity stretching from June 24 to November 18, 2025 and exposing names, phone numbers, email addresses, physical addresses, and order information. The incident shows how cloud identity governance fails when access outlives visibility, revocation, and offboarding.
Editorial analysis by NHI Mgmt Group, based on content published by Unosecur: “Coupang Data Breach 2025: Lessons in Identity & Offboarding Risk”.
By the numbers:
- 33.7 million customer accounts were affected by the Coupang breach.
Key questions
Q: What breaks when teams cannot quickly revoke access to cloud resources during offboarding?
A: When access revocation is slow, former employees or contractors can retain permissions longer than intended across groups, licenses, repositories, and other shared resources.
Q: Why do stale cloud permissions increase the impact of a breach?
A: Stale permissions enlarge the set of data and systems reachable from a compromised identity, which increases the blast radius of any unauthorized session.
Q: How can security teams know if cloud identity governance is actually working?
A: The clearest signals are fewer unresolved access findings, shorter evidence-collection cycles, lower counts of stale keys, and reduced reliance on manual review.
Practitioner guidance
- Map effective cloud access, not just assigned roles Reconcile live entitlements, sessions, tokens, and delegated permissions against the business owner for each critical cloud account.
- Tie offboarding to credential and session revocation Require revocation of keys, tokens, and active sessions as part of every leaver or mover workflow, including contractor and vendor offboarding.
- Inventory non-human identities with the same rigor as workforce accounts Create a single inventory for service accounts, API keys, certificates, and automation credentials so review cadence, ownership, and risk scoring apply across all identity types.
Bottom line: The Coupang breach reinforces that cloud identity failures can create extended exposure windows even when the intrusion method is not publicly disclosed.
What's in the full article
Unosecur's full blog post covers the operational detail this analysis intentionally leaves for the source:
- The article's incident timeline and disclosure details from Coupang's public notice
- The identity-risk interpretation the vendor draws from cloud access persistence and offboarding gaps
- The specific industry figures it cites on offboarding failures and insider-related exposure
- The vendor's walkthrough of how continuous identity security is positioned against stale cloud access
👉 Read Unosecur's analysis of the Coupang breach and cloud identity risk →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 5:29 am
Cloud identity risk is now a control-plane problem, not a perimeter problem. The Coupang incident shows that once authorization exists, cloud systems can preserve access long enough for exposure to become operationally significant. The issue is not just intrusion prevention, but whether effective access is continuously governed after issuance. Practitioners should treat runtime privilege as the security boundary.
A few things that frame the scale:
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What is the difference between assigned access and effective access in cloud IAM?
A: Assigned access is what appears in policy or directory records, while effective access is what can actually be used right now through roles, sessions, tokens, or delegated permissions. Effective access is the security reality that matters during a breach. Organisations need both views, but only effective access tells them what an attacker could do.
👉 Read our full editorial: Coupang data breach shows cloud identity risk outlasting controls