‘K-Delivery’ once touted by Coupang Taiwan hits a ‘red light’···Its growth formula and crisis response look alike - 경향신문

This article was translated by an AI tool. Feedback Here.

Coupang's headquarters building in Songpa-gu, Seoul. Reporter Seong Dong-hoon

Coupang has faced its biggest crisis in the Taiwanese market it has cultivated as a ‘second Korea’. Amid the continuing fallout from the massive personal data leak in Korea, it was belatedly confirmed that information on about 200,000 customers in Taiwan was also illegally accessed, switching on a red light for Coupang's growth in Taiwan, which had been led by ‘K-Delivery’.

Coupang Inc., listed on the New York Stock Exchange, said on the 26th (local time) in its fourth-quarter and annual consolidated results filed with the U.S. Securities and Exchange Commission (SEC) that consolidated revenue for 2025 totaled about $34.534 billion (about 49.1197 trillion KRW). This is a 14% increase from the previous year ($30.268 billion).

Analysts say this growth is underpinned by the expansion in the Taiwan business. Coupang Inc. Chairman and founder Kim Bom-seok said on the earnings conference call that “the Taiwan business and growth businesses (Developing Offerings) such as Coupang Eats are expanding rapidly.” He particularly noted that the Taiwan business has been maintaining triple-digit growth.

On a conference call last November, Chairman Kim also said, “Growth momentum in Taiwan is accelerating, and this quarter, revenue increased significantly year-on-year and quarter-on-quarter.” He expressed confidence in long-term growth potential, saying, “The way Taiwanese customers use the service is similar to the early stage when we were building the retail business in Korea.”

According to a February 27 report by Taiwan Economic Daily, Coupang rapidly built its own last-mile logistics network in Taiwan and now covers about 70% of areas. As of last December, about 75% of orders achieved ‘next-day delivery’. The assortment expanded from fast-moving consumer goods (FMCG) to a variety of categories, and in December about 75% of deliveries were completed using its own vehicles.

A Coupang delivery vehicle is parked in a parking lot in Seoul. Reporter Kwon Do-hyun

Coupang's choice of Taiwan as the first step in its global expansion is seen as the result of careful calculations. Coupang entered Taiwan in 2021 and grew rapidly. Taiwan, with an area similar to Gyeongsang Province and a population of about 23 million, has a population density of 640 people per ㎢, higher than Korea. With logistics hubs highly concentrated, it is an environment where e-commerce and delivery service efficiency can be maximized. Internet usage exceeds 94%, and the world's highest density of convenience stores (one per 1,500 people) has established a model of ordering online and picking up at convenience stores.

Taiwan Business TOPICS, published by the American Chamber of Commerce in Taiwan, cited Korean fresh foods, household goods, cosmetics, and electronics as popular Coupang items in a December report last year. Julia Tu, an analyst at the Market Intelligence & Consulting Institute (MIC), assessed that “Coupang's aggressive expansion is the result of its long-term ambitions aligning with the strategic value of the Taiwan market.” She explained that when Coupang entered Taiwan in mid-2021, it pursued an active subsidy strategy targeting price-sensitive consumers. In particular, it focused on parents buying baby products, consumers of daily necessities, and snack buyers to form early usage habits and rapidly expand its user base.

Coupang launched ‘Rocket Delivery’ and ‘Rocket Direct Purchase’ in 2022, and opened a second logistics center in Taoyuan in 2023. In 2024, it established an overseas shipping subsidiary and built a third logistics center. This year, it also introduced the WOW membership program in Taiwan. In effect, it applied its Korean success formula to Taiwan as is.

However, its rocket-like growth hit a wall: security. In a notice on the 26th, the Department of Digital Industries under the Ministry of Digital Affairs said that an administrative inspection team composed of legal and information security experts, the Criminal Investigation Bureau, and the National Center for Cyber Security Technology conducted an administrative inspection at Coupang's Taiwan entity the previous day and “found defects in the personal data management of Coupang's Taiwan entity.”

According to the investigation, the attacker, a former employee of Coupang's Korean entity, accessed the personal data of 204,552 Coupang Taiwan users through more than 2,000 different IP addresses. The data accessed included names, emails, phone numbers, delivery addresses, and some order records.

The Taiwanese side said Coupang Taiwan had previously stated that user databases in Taiwan and Korea were separated, but the investigation confirmed that access was possible because the backup keys for the different databases were identical.

The Department of Digital Industries said that immediately after the personal data leak occurred last November, it asked Coupang Taiwan for an explanation, and at the time Coupang announced that “no evidence had been found that Taiwanese consumers' personal data had been leaked.” It added that Coupang maintained the position that “there is no evidence of impact on Taiwanese users” during an administrative inspection on December 24 last year and again on January 12 and 26 this year, as well as on the 9th of this month.

However, the Korean government's findings announced on February 10 included content from an email the attacker sent to Coupang's Korean entity last November stating that users in Korea, Japan, and Taiwan would all be affected. The Department of Digital Industries pointed out that Coupang Taiwan did not notify the Taiwanese side of the personal data leak until February 23.

Observers say the response patterninitial denial followed by belated acknowledgmentmirrors the Korean case.

According to local media including the Commercial Times, Coupang Taiwan issued an apology on the 24th and announced a compensation plan totaling TWD 200 million. It will provide each affected customer with shopping discount coupons worth TWD 1,000. Earlier, during thepersonal data leak incident in Korea, Coupang proposed purchase vouchers totaling $38 (50,000 KRW) across Coupang, Coupang Eats, and Coupang Travel as a compensation measure.

Coupang Taiwan said that highly sensitive information was not leaked, the route of leakage had been blocked, all related equipment had been recovered, and there were no indications of data misuse so far. However, controversy continues over the manner of its explanation. Attorney Huang Pei-sheng of Richin International Law Office told Business Next that “Coupang is distinguishing between the concepts of ‘retained’ and ‘accessed’.” He said, “Even if only a small set of data was retained, the fact that a single employee could access more than 200,000 accounts means separation of duties and the principle of least privilege were not functioning properly.”

Under Taiwan's Personal Data Protection Act framework, the core issues include not only whether data were actually retained, but also the unauthorized access itself and the adequacy of a company's internal control systems.

The results of the Department of Digital Industries' administrative investigation are expected as early as within 10 business days. As Coupang, which has pursued the same growth strategy as in Korea, appears to have followed a similar playbook in crisis response, observers say cracks have formed in local trust. Business Next assessed that regardless of the level of sanctions, this incident appears to have dealt a significant blow to consumer trust in Taiwan toward Coupang.