Quiet flight from Coupang after data breach deepens pain for small vendors

By Lee Jung-woo Posted : December 5, 2025, 16:58 Updated : December 5, 2025, 16:58
Coupang Headquarters in Songpa-gu Seoul Yonhap
Coupang Headquarters in Songpa-gu, Seoul. Yonhap
SEOUL, December 05 (AJP) - Fallout from Coupang’s massive data breach is widening beyond consumers to tens of thousands of small vendors across South Korea who rely on the e-commerce giant as a primary sales channel and livelihood.

The National Assembly Science and ICT Committee has scheduled another hearing on Dec. 17 to examine a growing number of complaints against Coupang, including difficulties in canceling subscriptions or discontinuing platform use. Lawmakers say the scale and sensitivity of the data leak — which affected nearly all of Coupang’s 34 million users — warrant continued scrutiny.

Market researcher IGAWorks showed that Coupang’s daily active users, which had hovered around 18 million before the breach, slipped to 17.8 million but have so far remained above the 17 million mark.

Instead of a mass exodus, industry data suggest a “silent boycott”: customers reducing their use of Coupang for daily shopping or avoiding Coupang Eats for food delivery due to loss of trust.

That shift has delivered a sharp blow to vendors and dining partners.

A café owner in Gwangju said delivery orders via Coupang Eats “dropped to zero,” with daily sales falling more than 20 percent from a week earlier. A seafood company selling primarily through Coupang reported a more than 30 percent slide in revenue.

According to Coupang’s internal “Impact Report 2025,” released in September, the company serviced around 230,000 small businesses as of 2023 — roughly 75 percent of all its vendors — generating a combined 12 trillion won ($8.2 billion) in annual transactions. 

The data leak now exposes them to a double shock: plunging sales and anxiety over potential compromise of business information.

“I’m massively anxious. I changed all my business account passwords, but it feels like they’ve already been stolen,” said the owner of a Korean beef stew shop in downtown Seoul. “Coupang Eats accounts for a large proportion of my orders, so even if I want to quit, I can’t. It used to be about 50–50 between Baemin and Coupang Eats, but now it’s closer to 45–55 because more customers use Coupang Eats.”

Holding up a text alert from the platform, she added, “Coupang said a delivery address was leaked. I panicked. I deleted my personal account, but I can’t delete my business account — how else can I run my shop?”
 
A data breach notice text received by the Korean beef soup restaurant owner AJP Lee Jung-woo
A data breach notice text received by the Korean beef soup restaurant owner/ AJP Lee Jung-woo
A Coupang executive, speaking anonymously to AJP, said vendor information is stored in a separate system that “shows no abnormal signs,” and stressed that partner data remains protected.

Other shop owners said Coupang Eats’ appeal makes it difficult to exit despite safety concerns. 

“Customers prefer Coupang. Baemin assigns riders through its system, which takes more time. Coupang uses individual drivers, so deliveries are faster,” said one operator. 

Coupang Eats has expanded rapidly this year, leveraging its ultra-fast delivery model and free deliveries for Coupang subscribers. It held a 37.6 percent market share in the food-delivery sector, trailing No. 1 Baemin’s 56.7 percent.

“We live in a paradox,” said Lee Joong-seon, secretary-general of the National Franchise Owners Association. “Even when sales are high, small business owners make little profit because of the massive commission fees charged by platforms like Coupang and Baemin. When sales are low, life gets harder. Either way, we lose. And now, after the Coupang data leak, it feels like insult upon injury.”

The Korean Federation of Micro Enterprises said it plans to collect vendor complaints and prepare for collective legal action if needed, according to member Ryu Pil-seon.

Meanwhile, consumer frustrations continue to mount. On Coupang’s PC version, account deletion requires a six-step process, including personal-information verification and a mandatory survey — a design critics say reflects the broader difficulty of disengaging from the platform even amid a crisis of confidence.
기사 이미지 확대 보기
닫기