Topic starter
06/09/2026 6:21 pm
TL;DR: A departed engineer’s still-valid credential enabled undetected access to customer data for roughly six months, contributing to a breach affecting 37.5 million people and a $409 million Korean regulatory fine, according to Securiti. The case shows that credential lifecycle control, data sensitivity context, and access telemetry must be governed together, because stale trust can become large-scale data exposure.
Editorial analysis by NHI Mgmt Group, based on content published by Securiti: “One Unrevoked Key, 37.5 Million People: What the Coupang data breach reveals about data access”.
By the numbers:
- The breach affected 37.5 million people, including 33.22 million Coupang users and about 4.33 million third-party data subjects.
Key questions
Q: What breaks when a departed identity still has valid access to sensitive data?
A: The access model breaks because offboarding has not fully removed the trust relationship that lets the identity reach production data.
Q: Why do valid user credentials create such a large breach risk in Windows environments?
A: Because a successful logon often looks indistinguishable from legitimate work unless the surrounding session behaviour is monitored.
Q: How can security teams tell when a trusted integration is being abused?
A: Look for drift from the approved behavioural baseline.
Practitioner guidance
- Tighten offboarding and revocation workflows Revoke signing keys, tokens, service credentials and application access as a single offboarding event, not as separate tickets with different owners.
- Map data reach to every privileged credential Identify which customer, regulated or high-value datasets each credential can reach, then prioritise review where the reachable data creates the largest blast radius.
- Correlate identity and access telemetry Join authentication logs, source location, token issuance and sensitive-data consumption so repeated access against the same records becomes visible as a pattern.
Bottom line: A departed identity with still-valid access can turn ordinary authentication into prolonged exposure of customer data if downstream controls are weak.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/09/2026 6:22 pm
Credential lifecycle is a data security control, not just an IAM housekeeping task. The Coupang case shows that a valid credential can be the mechanism of exposure long after an employee departs, which means offboarding, key revocation and ownership tracking are inseparable from data protection. Organisations that treat revocation as administrative cleanup miss the real issue: stale trust can persist until it is exercised against sensitive data. Practitioners should govern credential retirement as an active risk-reduction control.
A few things that frame the scale:
- Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems. Organisations failing to scope AI access properly are 4.5x more likely to experience a security incident, according to the 2026 Infrastructure Identity Survey.
- 62% of organisations are at least experimenting with AI agents, but only 23% have scaled one into a single business function, according to McKinsey's 2025 State of AI survey.
A question worth separating out:
Q: Who should be accountable for revoking stale access to customer data?
A: Identity, platform and data governance owners should share accountability, because the failure spans credential lifecycle, application access and data protection. If any one team owns the problem alone, the organisation usually ends up with a gap between offboarding, revocation and data-risk review that attackers or insiders can exploit.
👉 Read our full editorial: One unrevoked key can expose millions through data access