how it happened
- whoformer employeeleft the company
- the gapretained accessnever revoked
- thencustomer systemsno leaver check caught it
- the result33.7M customersCEO resigned
what everyone assumed
Offboarding feels like an HR workflow with an IT step at the end, and the IT step feels binary: the account is closed, therefore the person is out. It is a reasonable belief, because it is how the checklist reads and how it works for every system anyone remembers to list. The gap lives in the systems nobody listed, where a departure is just a login that stopped being used, until it starts again.
what happened
The access an ex-employee retained after departure did what retained access does: it authenticated, validly, raising none of the alarms built for intruders, because to every system involved this was a known credential doing known things. No comparison of leaver lists against active accounts caught it in time. The quiet held until the scale of what that access had reached made quiet impossible.
step by step
- an employee leavesTheir access is never revoked.the assumption breaks here
- the retained access is usedIt authenticates validly and raises none of the intruder alarms.
- no leaver check catches itNobody compares the leaver list against active accounts in time.
- late November 2025Coupang discloses the breachReported as South Korea's largest; the chief executive resigns on 10 December.
how it surfaced
In late November 2025, Coupang disclosed a breach traced to that ex-employee’s retained access. Reporting described it as the largest data breach in South Korea’s history. Its chief executive resigned on 10 December 2025. The post-incident story reduced to a single administrative fact: a departure that did not revoke access.
Offboarding is a security control, and it fails like one.
When it fails, the failure is invisible for exactly as long as nobody checks, because a leftover credential looks like a user, behaves like a user, and appears on no intruder-detection radar. The country’s largest breach and a CEO’s resignation is what that invisibility can cost.
picture it at a company like yours
The company here is made up. The other two paths are not: they happened, and each links to the story.
- in this storythe day it mattersMonths later, the access still works and they use it.what it costs youYour customer data leaves through a door everyone assumed was closed.
- or it goes like thisit happenedCash App / Block, 2022howThe person logs back in from home, weeks after leaving.what leavescustomer lists and reportswho ends up with itthe former employee and whoever they work for next
- or it goes like thisit happenedColonial Pipeline, 2021howThe forgotten account's password turns up in a breach dump.what leavesa working way into the networkwho ends up with ita ransomware crew
sources
your turn
what you can do about it
this week
Put last quarter's leavers next to the active accounts in your five most important systems.
Someone left your company this quarter, and their directory account is closed, which is why nobody is thinking about them. The question is everything beyond the directory: this week, take your last quarter's leavers and put the list next to the active accounts of your five most important systems. Coupang's gap was findable by exactly that comparison, on any week before November.
go deeper
if you're not sure where to start
Run the offboarding checklist on one leaver. It covers every account and token to close when someone leaves.
open the checklist →