Topic starter
24/12/2025 9:16 am
TL;DR: Unosecur reports that Coupang disclosed unauthorized access affecting 33.7 million customer accounts, with activity dating back to June 24, 2025 and detection on November 18, 2025, while the company said names, phone numbers, email addresses, physical addresses, and order information were exposed. The incident shows how cloud identity controls can fail when access governance and visibility lag behind live permissions, leaving prolonged exposure without clear attacker attribution.
Editorial analysis by NHI Mgmt Group, based on content published by Unosecur: “Coupang Data Breach 2025: Lessons in Identity & Offboarding Risk”.
By the numbers:
- Coupang said the breach affected 33.7 million customer accounts.
- Coupang identified unauthorized access on November 18, 2025, but said the activity dated back to June 24, 2025.
Key questions
Q: What breaks when cloud identity access is not revoked quickly after a role change or departure?
A: The access path can outlive the business relationship that justified it, which means an apparently valid account or token may still reach sensitive data long after it should have been closed.
Q: Why does delayed identity revocation increase the impact of cloud breaches?
A: Because the longer access remains valid, the more time an attacker has to browse, collect, and quietly extract data without needing fresh compromise.
Q: What are the signs that cloud access governance is failing after an identity breach?
A: Cloud access governance is failing when teams cannot quickly tell who had access, what was approved, and which resources were reachable at the time of compromise.
Practitioner guidance
- Enforce deterministic offboarding Tie every account, token, key, and delegated access path to an explicit termination event so revocation cannot wait on manual cleanup.
- Shorten identity review cycles Reassess granted permissions on a cadence that matches cloud change velocity, especially for customer-data environments and privileged access paths.
- Track stale and dormant access paths Continuously identify accounts and credentials that remain active after their business purpose has ended, then verify whether they are still justified.
Bottom line: The Coupang disclosure is a cloud identity governance case, not only a data breach case, because access appears to have persisted long enough to expose customer information at scale.
What's in the full article
Unosecur's full blog covers the operational detail this post intentionally leaves for the source:
- The article’s breakdown of how the breach fits the broader identity-first cloud risk pattern
- The vendor’s discussion of continuous identity security and how it frames human and non-human identities
- The specific access-risk examples that support its view of over-privileged and dormant cloud access
- The concluding product context around hidden access risk and cloud identity visibility
👉 Read Unosecur's analysis of the Coupang breach and cloud identity risk →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 10 months ago by Abdelrahman
This topic was modified 5 days ago by NHI Mgmt Group
07/10/2026 6:09 pm
Cloud identity risk persists when organisations treat access as a setup task rather than an active control boundary. Coupang’s disclosure shows how long-lived unauthorized access can create large-scale exposure even when the attacker method is unknown. In cloud environments, entitlement drift, delayed revocation, and limited visibility are not edge cases. They are the conditions under which identity-first compromise becomes durable. The practitioner conclusion is that cloud identity governance must be operational, not episodic.
A few things that frame the scale:
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should organisations handle cloud breach response when the attacker method is still unknown?
A: Start by treating the identity path as the incident boundary. Preserve logs, confirm which accounts and tokens were valid during the exposure window, revoke anything suspicious, and map what data those identities could reach. When the method is unknown, access scope and session history are the fastest route to containment.
👉 Read our full editorial: Coupang breach shows how cloud identity risk can persist for months