Notifications
Clear all
Topic starter
06/09/2026 6:21 pm
TL;DR: A departed engineer’s still-valid credential enabled undetected access to customer data for roughly six months, contributing to a breach affecting 37.5 million people and a $409 million Korean regulatory fine, according to Securiti. The case shows that credential lifecycle control, data sensitivity context, and access telemetry must be governed together, because stale trust can become large-scale data exposure.
NHIMG editorial — based on content published by Securiti covering the Coupang data breach and data access control failures
By the numbers:
- Securiti says the incident affected 37.5 million people, including 33.22 million users and roughly 4.33 million third-party data subjects.
Questions worth separating out
Q: What breaks when a departed employee’s signing key is still valid?
A: A departed identity can still mint or use trusted access, which means the system may treat the session as legitimate even though the human relationship is gone.
Q: Why do stale accounts make credential compromise worse?
A: Stale accounts extend the time an attacker can use a valid password without raising suspicion.
Q: How can security teams tell whether credential governance is mature enough?
A: Look for measurable controls, not claims of modernisation.
Practitioner guidance
- Map every credential to reachable data sets Build an entitlement-to-data map for human, service, and signing credentials so teams can see which sensitive records each identity can actually reach.
- Revoke dependent access at offboarding time When a person leaves or changes role, revoke signing keys, refresh tokens, API keys, and any downstream application trust that depends on that identity.
- Correlate access age with data sensitivity Use access telemetry and classification context to flag long-lived credentials that continue reading sensitive datasets after role change, departure, or inactivity.
What's in the full article
Securiti's full article covers the operational detail this post intentionally leaves for the source:
- A phase-by-phase breakdown of the Coupang access failure, including the regulator's findings and the access-control gaps.
- The data access intelligence model used to connect entitlement, activity, and dataset sensitivity across the estate.
- Step-by-step remediation priorities for offboarding, key rotation, and evidence preservation in breach response.
- The table of incident-phase questions that helps teams test whether they can prove who or what touched sensitive data.
👉 Read Securiti's analysis of the Coupang breach and data access failure →
Unrevoked credentials and data access: what teams need to know?
Explore further
06/09/2026 6:22 pm
Credential lifecycle is a data security control, not just an IAM hygiene task. This breach shows that revocation timing matters only when it is tied to the systems a credential can reach. A valid key with broad data reach is a standing exposure window, not merely a stale account. For identity teams, lifecycle failure must be treated as an active data-risk condition, not an administrative cleanup issue.
A few things that frame the scale:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, inappropriately sharing sensitive data, and revealing access credentials, according to AI Agents: The New Attack Surface report.
- Only 33% of organisations report that their AI agents have accessed inappropriate or sensitive data beyond intended scope, which still leaves a substantial governance blind spot for identity and data teams.
A question worth separating out:
Q: Who is accountable when access persists after termination and a breach follows?
A: Accountability should be shared across IAM, data security, privacy, and legal operations, because the control failure spans credential lifecycle, data exposure, notification, and evidence handling. Frameworks such as NIST CSF and NIST SP 800-53 expect clear ownership for access control and incident response, not informal handoffs.
👉 Read our full editorial: One unrevoked key can expose millions through data access
