Coupang faces a record $409 million fine for a data breach impacting 37 million users, amidst several other cybersecurity incidents this week.
In a week marked by significant cybersecurity events, South Korea's Coupang was hit with a record fine of approximately $409 million due to a massive data breach affecting over 37 million users.
Coupang Faces Record Fine for Data Breach
The Personal Information Protection Commission of South Korea (PIPC) announced the fine of 624.6 billion won after determining that Coupang's security measures were inadequate, leading to unauthorized access to personal data. The breach, which occurred in June 2025 but was only identified in November, exposed sensitive information of about 37.55 million individuals. Coupang Fulfillment Service, a subsidiary of Coupang, was also fined 248 million won for mishandling customer data.
PIPC's investigation revealed significant lapses in authentication key management and access control, as well as failures in data destruction protocols. The breach was traced back to a former employee, a 43-year-old Chinese national who worked in IT from 2022 to 2024.
Microsoft Disables GitHub Repositories After Claude Code Breach
In another incident, Microsoft restricted access to dozens of open-source repositories on GitHub after a malware attack affected Claude Code users. The breach, linked to a hacker campaign named Miasma, involved at least 70 projects, many related to Azure, and was designed to steal sensitive information from users.
Microsoft's Ben Hope stated that the company is actively checking these repositories for malicious content, with some already restored. Analysts from Cloudsmith have advised users to change SSH keys and passwords and to monitor for unusual activities in their coding environments.
Hacktivists Target Ukraine Through WinRAR Vulnerability
Ukrainian government institutions were targeted by hacktivist groups SHADOW-EARTH-066 and Gamaredon, exploiting a vulnerability in the WinRAR archiver. This flaw allowed attackers to save malicious files outside the intended directory, facilitating the installation of info stealers like GIFTEDCROOK and malware such as GammaWorm.
Experts noted that the widespread use of an outdated WinRAR version in Ukraine makes it a prime target for cyberattacks.
OpenClaw Fails Phishing Tests
In a separate cybersecurity study, researchers found that OpenClaw, an AI email handling agent, struggled against phishing attacks. Tests revealed it could be easily manipulated into sharing sensitive information, highlighting vulnerabilities similar to those faced by human users.
Researcher Continues Battle with Microsoft Over Vulnerabilities
Cybersecurity researcher Nightmare Eclipse revealed a new zero-day vulnerability in Microsoft Defender, dubbed RoguePlanet, which allows privilege escalation on fully updated Windows systems. This incident adds to a series of vulnerabilities he has publicly disclosed following Microsoft's patches, maintaining a contentious relationship with the tech giant.
