# The Guy Who BUILT Coupang's Login Security Stole the Master Key — 37M People Leaked, $409M Fine **URL:** \ **Category:** News & Articles\ **Tags:** hacking, privacy, business, tips-tricks, news\ **Created:** [7 Agosto, 2026 15:03 UTC](https://onehack.st/t/the-guy-who-built-coupangs-login-security-stole-the-master-key-37m-people-leaked-409m-fine/324527 "2026-08-07T15:03:00Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![BlueHacker](https://onehack.st/user_avatar/onehack.st/bluehacker/32/174721_2.png) [@BlueHacker](https://onehack.st/u/BlueHacker)\ **Post date:** [7 Agosto, 2026 15:03 UTC](https://onehack.st/t/the-guy-who-built-coupangs-login-security-stole-the-master-key-37m-people-leaked-409m-fine/324527/1 "2026-08-07T15:03:01Z")
# 🔑 The Guy Who BUILT Coupang’s Login Security Stole the Master Key — 37M People Leaked _No genius hack. No zero-day. Just one dude who kept a copy of the key he made — then walked back in months later._ **$409 million fine (biggest in South Korea’s history) → 33,222,472 members leaked → +4,338,368 people who never even had accounts → all from ONE stolen signing key.** Coupang is basically the Amazon of South Korea. And the country’s privacy regulator just said the leak didn’t come from some elite cyber-army — it came from “deficiencies in basic safety management.” Translation: they left the door open. [Full story at The Record.](https://therecord.media/south-korea-data-breach-record-fine-coupang) ![Vault heist GIF](https://media.giphy.com/media/xTiTnHXbRoaZ1B1Mo8/giphy.gif) > **🧩 Dumb Mode Dictionary** > > | Term | What it actually means | > | --- | --- | > | **Signing key** | A secret master password that proves “yes, this login system is really me.” Whoever holds it can wave the guards through. | > | **Insider threat** | The danger isn’t a stranger outside — it’s someone who used to work there and still has the keys. | > | **Authentication system** | The bouncer at the door that checks “are you really you?” before letting you into your account. | > | **PIPC** | South Korea’s privacy police. They hand out the fines. [Wiki here.](https://en.wikipedia.org/wiki/Personal_Information_Protection_Commission) | > | **Offboarding** | The checklist a company _should_ run when you quit — kill your logins, take back your keys. Coupang skipped a big one. | > **🕵️ How this actually went down (it's dumber than you think)** > > Here’s the play, step by step: > > - A software engineer — a Chinese national — worked at Coupang and **personally built** their backup login system. > - Before he quit at the **end of 2024** , he quietly copied the signing key → the one master secret that whole system trusted. > - The breach happened in **late June** → but nobody at Coupang noticed until **mid-November**. That’s ~4 months of a wide-open barn. > - Because he made the lock himself, he knew exactly where every weak spot was. → No brute force needed. > > Between you and me? This is the oldest trick in the book. The scariest hacker isn’t a stranger. It’s the person who _built the wall_ and remembers where the loose brick is. [More detail on BleepingComputer.](https://www.bleepingcomputer.com/news/security/south-korea-hits-coupang-with-record-409-million-fine-over-data-breach/) > **📊 The receipts (the numbers that matter)** > > | Thing | Number | > | --- | --- | > | Members leaked | 33,222,472 | > | Non-members leaked (people stored as delivery recipients!) | 4,338,368 | > | The fine | 624.7 billion won ≈ **$409 million** | > | Previous record fine (SK Telecom, earlier same year) | $88.8 million | > | Payout Coupang promised customers | ~$1.17 billion | > | Voucher per affected customer | 50,000 won ≈ **$34** | > > That non-member number is the sneaky part. → You never signed up for Coupang, but a friend shipped you a gift → your **name, phone number, and home address** got stored → and leaked. You got robbed by a store you never shopped at. [Korea Times has the local angle.](https://www.koreatimes.co.kr/amp/business/companies/20260611/coupang-hit-with-record-409-mil-fine-over-massive-data-breach) > **🗣️ What the timeline's saying** > > - Security folks are basically screaming “THIS is why offboarding matters” into the void. > - The wild part everyone keeps repeating: the regulator said it wasn’t sophisticated hacking → it was **basic** stuff Coupang didn’t lock down. > - And that $34 voucher for having your home address leaked? People are… not thrilled. It’s like getting a coupon after someone reads your diary. > - Bigger picture: signing keys are the new crown jewels. If your company treats them like a sticky note, you’re one resignation away from the news. [Good primer on secrets management from GitHub.](https://docs.github.com/en/code-security/secret-scanning/about-secret-scanning) #### Cool. Some Guy Kept a Copy of the Master Key and Nuked 37 Million People… Now What the Hell Do We Do? (⊙\_⊙) ![Sneaking out with a briefcase GIF](https://media.giphy.com/media/r6uielUJrGGmVcJ3GL/giphy.gif) Every panic is a market. When a $409M fine hits the front page, thousands of companies suddenly realize _they_ have the same loose brick → and they’ll pay somebody to find it first. Here’s where the money’s hiding. > **🕳️ The Ghost Key Hunter** > > Departing engineers leak secrets by accident all the time — pasted into public code, old repos, forgotten config files. There are FREE tools that scan the internet for exactly these leaked keys. You run the scan → you find the exposed key → you politely email the small company that owns it before a bad guy does. > > 🧠 _Example:_ A 23-year-old in Lagos runs [TruffleHog](https://github.com/trufflesecurity/trufflehog) (free, open-source) against public code repos every night, filters for leaked signing/API keys tied to small e-commerce shops, and sends a one-line “hey, this is exposed, I can help you rotate it” email. Charges a flat $150 finder’s fee + $200 to help fix it. 6 clients in month one → $2,100. > > > 📈 **Timeline:** First responses in ~2 weeks (most people ignore cold emails — volume is the game). Plateaus once the easy public leaks in your niche dry up (~3-4 months) — then you pivot to a paid monitoring retainer. > **📋 The Offboarding Snitch List** > > Coupang’s whole $409M nightmare = they didn’t take back one guy’s key when he quit. Tiny companies have ZERO system for this. Here’s what you do: build a dead-simple “when someone quits, kill THESE 20 things” checklist as a paid template, tuned per industry. > > 🧠 _Example:_ A 27-year-old ops person in Manila packages a Notion + Google Sheet “Offboarding Kill-Switch Kit” (revoke keys, transfer 2FA, audit shared logins) and sells it on [Gumroad](https://gumroad.com/) for $29. Posts one breakdown of the Coupang story in HR + startup subreddits → 340 sales in 6 weeks → ~$9,800. No code, no meetings. > > > 📈 **Timeline:** Sales spike hard for ~4 weeks while the Coupang headline is hot. Long tail after that — bundle in updates so buyers come back. > **🎟️ The Voucher Whisperer** > > 33 million confused people just got told they’re owed a $34 voucher and $1B+ in payouts — and most have NO idea how to actually claim it or what their rights are. The first clear, dead-simple “how to claim your money + protect yourself” guide becomes the thing everyone links to. Be the dictionary. > > 🧠 _Example:_ A 25-year-old in Seoul writes one clean Korean-language “Am I affected? Here’s exactly how to claim your Coupang compensation” page, ranks it on Google/Naver for the breach terms, and monetizes with a free password-manager + credit-monitoring affiliate link at the bottom (like [Bitwarden](https://bitwarden.com/)). 40,000 visitors in the first month → a few hundred signups → steady side income. > > > 📈 **Timeline:** First traffic within days of publishing (breach searches spike immediately). Fades over ~8 weeks as news cools — so template it and reuse the same page for the _next_ breach. > **📡 The Breach-Signal Reseller** > > Reverse the data flow. Public breach databases already exist for free. But small local businesses in one country/language have no easy way to check if THEIR customer emails are in a fresh dump. Bridge that gap → charge a tiny monthly fee for “we’ll warn you if your customer list shows up in a leak.” > > 🧠 _Example:_ A 24-year-old in Jakarta builds a bare-bones checker on top of the free [Have I Been Pwned API](https://haveibeenpwned.com/API/v3), wraps it in a simple dashboard for local online sellers, and charges $9/month per shop to auto-alert them. 60 shops → $540/month recurring, mostly hands-off after setup. > > > 📈 **Timeline:** First paying shop within ~2 weeks of demoing it. Real money at ~50+ subscribers (2-3 months). Watch for the API’s usage limits — that’s your ceiling, plan pricing around it. > **🔑 Sell the Shovels, Not the Gold** > > Everyone’s freaking out about insider key theft → but almost nobody wants to _learn_ how to rotate secrets properly. So sell them the boring pre-made tool. Package ready-to-run scripts + a step-by-step “rotate every key in 1 hour” playbook. Picks-and-shovels always outlast the hype. > > 🧠 _Example:_ A 29-year-old dev in Kraków bundles ready-made key-rotation scripts (built around free tools like [HashiCorp Vault](https://developer.hashicorp.com/vault) and [git-secrets](https://github.com/awslabs/git-secrets)) into a $49 “Insider-Proof Starter Pack” on Gumroad, plus a 20-min setup video. Shares it in dev communities right as the Coupang fine trends → 180 sales → ~$8,800, and it keeps selling on autopilot. > > > 📈 **Timeline:** First sales within days if you ride the news wave. Steady drip after — refresh the scripts every few months so it stays the “current” version people trust. > **🛠️ Follow-Up Actions** > > | If you want to… | Do this | > | --- | --- | > | Hunt exposed keys | Run [TruffleHog](https://github.com/trufflesecurity/trufflehog) on public repos | > | Sell a template | Ship it on [Gumroad](https://gumroad.com/) — zero code needed | > | Check breach exposure | Use the [HIBP API](https://haveibeenpwned.com/API/v3) | > | Understand the fine | Read [The Record’s report](https://therecord.media/south-korea-data-breach-record-fine-coupang) | > | Lock down your own keys | Start with [git-secrets](https://github.com/awslabs/git-secrets) | **⚡ Quick Hits** | You want… | Here’s the move | | --- | --- | | 🔍 To find leaked keys before the bad guys | Scan public code with [TruffleHog](https://github.com/trufflesecurity/trufflehog) | | 💼 A no-code product to sell today | Package an [offboarding checklist](https://gumroad.com/) | | 🛡 To protect your own accounts | Grab a free [password manager](https://bitwarden.com/) + turn on 2FA | | 📖 The full story | [The Record](https://therecord.media/south-korea-data-breach-record-fine-coupang) / [BleepingComputer](https://www.bleepingcomputer.com/news/security/south-korea-hits-coupang-with-record-409-million-fine-over-data-breach/) | | 🧠 To learn insider-threat basics | Read up on [secret scanning](https://docs.github.com/en/code-security/secret-scanning/about-secret-scanning) | _The strongest lock in the world means nothing if the locksmith keeps a copy of the key. Check who’s still holding yours._