A former employee of Coupang—South Korea’s largest e‑commerce platform—allegedly stole a security key, accessed customer data, and then tried to destroy evidence by smashing a MacBook Air and dumping it in a river. Investigators still recovered the laptop, extracted its serial number, linked it to the suspect’s iCloud account, and found attack scripts on a separate PC. Despite the physical destruction attempt, digital forensics preserved the truth—and the timeline.
The incident reportedly exposed data related to 33 million customers and triggered a ₩50,000 (~$35) voucher to each affected user—an estimated $1.17B impact—while regulators opened a formal inquiry into Coupang’s security operations.
In this article, you’ll learn how digital forensics in incident response works in practice, what went right and wrong, how to close gaps (insider threat, key management, logging, chain of custody), and which frameworks (NIST, ISO/IEC, MITRE ATT&CK) to use to raise your organization’s readiness.
TL;DR — Key Takeaways
- Digital forensics can reconstruct events even when devices are physically destroyed.
- Insider threat + key misuse remains a high‑impact, low‑friction breach vector.
- Chain-of-custody and evidence handling enable defensible investigations.
- Controls that matter: least privilege, PAM, key governance, EDR/DFIR, SIEM, UEBA, immutable logging, and Zero Trust.
- Frameworks to align with: NIST SP 800‑61/800‑86, ISO/IEC 27035/27001, and MITRE ATT&CK.
The Coupang Case: What Happened
- A former employee is accused of stealing a security key while employed and using it to access customer records (order histories, building access codes used by delivery personnel).
- Access reportedly touched ~3,000 customers directly via a personal computer and a MacBook Air—yet the company disclosed exposure to 33M customers and offered vouchers across that population after forensic review.
- After the incident surfaced in the media, the suspect allegedly smashed the MacBook, placed it with bricks in a canvas bag, and threw it in a river.
- Investigators recovered the MacBook, extracted its serial number, matched it to the accused’s iCloud information, and found attack scripts on a separate PC.
- The company stated the perpetrator did not transfer stolen data beyond two devices and deleted data after news reports emerged, but the impact remained severe given the population affected and the regulatory scrutiny.
Why this matters:
This is a textbook example of digital forensics in incident response: evidence recovery from damaged media, device attribution via serials and cloud associations, and timeline reconstruction via scripts and system artifacts. It also highlights insider threat realities—when employees have (or retain) sensitive access, traditional perimeter defenses are not enough.
What Is Digital Forensics in Incident Response?
Digital forensics is the discipline of identifying, preserving, analyzing, and presenting electronic evidence in a way that is legally defensible and operationally useful. In the context of incident response (IR), digital forensics helps teams:
- Contain: Determine the blast radius (affected identities, systems, data).
- Eradicate: Remove persistence, revoke access, rotate keys, and sanitize compromised systems.
- Recover: Restore normal operations without re‑introducing risk.
- Learn: Derive root cause and improve controls.
Core steps (DFIR workflow):
- Preservation & Collection — Freeze relevant data (images, logs, memory), maintain chain of custody, and ensure integrity (hashing).
- Examination & Analysis — Parse artifacts (file systems, logs, scripts), correlate with SIEM/EDR telemetry, build timelines.
- Attribution & Scope — Link identities, devices, infrastructure, and data access paths; quantify data at risk.
- Reporting & Remediation — Produce a defensible report, support legal/regulatory disclosure, and drive control improvements.
Primary keyword check: This section deliberately uses digital forensics in a heading and body to reinforce topical relevance.
How Investigators Prevail Even When Devices Are Destroyed
Physical destruction rarely eliminates all evidence. Why?
- Redundancy of artifacts: Evidence often exists across multiple systems (endpoint, servers, SaaS audit logs, identity providers, MDM/EDR, network telemetry).
- Identifiers persist: Serial numbers, device enrollment records, and account bindings (e.g., iCloud) tie devices to people.
- Residual data: Even damaged storage can yield metadata, partition residues, and recoverable blocks.
- Cloud/service logs: Server‑side access logs (API calls, IAM decisions, audit trails) are not on the endpoint.
In the Coupang case:
- Serial number → iCloud association provided identity linkage.
- Recovered scripts on a PC offered insight into TTPs (tactics, techniques, procedures).
- Forensics narrowed data movement, helping to assert whether data left controlled devices.
Real‑World Context: Recent Large‑Scale Incidents
| Incident | Organization | Year | Impact | Details |
|---|---|---|---|---|
| Coupang Data Breach | Coupang | 2025 | 33M Records | Insider key misuse; evidence recovery despite device destruction |
| SK Telecom Breach | SK Telecom | 2025 | 14.6M Records | Security misconfigurations; large regulatory fine |
| Indian Mobile Data Leak | Multiple | 2024 | 750M Records | SIM subscriber data sold on dark web |
| Previous Korean Breaches | Various | 2024–2025 | Multiple | Pattern of security incidents in Korean tech sector |
Pattern to note: Insider misuse, misconfiguration, and weak data governance continue to drive outsized impacts—often beyond the immediate scope of initially accessed records.
Common Misconceptions That This Case Debunks
- “If I destroy the device, the evidence is gone.”
Digital forensics routinely recovers attribution and activity from other systems, cloud logs, and residual media. - “If access was limited to a few thousand records, the impact is small.”
Legal, regulatory, and trust considerations can broaden the response to entire customer populations. - “We’ll rely on the SOC to find everything in real time.”
Without immutable logging, EDR coverage, and identity telemetry, the SOC can’t see what isn’t collected or retained. - “Keys are safe once issued.”
Security keys, tokens, and API secrets are high‑value assets. Without lifecycle controls (issuance, rotation, revocation, monitoring), they are breach enablers.
Risk & Impact Analysis
- Business impact: Direct remediation (customer notification/compensation), legal defense, regulatory fines, and brand damage can exceed any short‑term savings from under‑investing in controls.
- Operational impact: Emergency key rotation, credential resets, expanded monitoring, and forensic labor strain already busy teams.
- Safety impact: Exposure of building access codes introduces physical security risk—blending cyber and operational safety concerns.
- Regulatory impact: In South Korea, PIPA (Personal Information Protection Act) imposes strict obligations for breach notification, safeguards, and potential sanctions. Similar regimes (e.g., GDPR, CCPA/CPRA) apply elsewhere.
Bottom line: Insider misuse + weak key governance + insufficient auditability = high‑severity incidents with multi‑domain risk.
Best Practices: From Prevention to Proof
1) Identity, Access & Least Privilege
- Enforce Zero Trust: authenticate and authorize every request.
- Apply role‑based access control (RBAC) and attribute‑based access control (ABAC).
- Require strong MFA (phishing‑resistant FIDO2 where applicable).
- Just‑in‑time (JIT) and time‑bound access for sensitive systems.
- Continuous access review and certification for privileged roles.
2) Key & Secret Governance
- Centralize keys in HSM‑backed or cloud KMS; avoid local copies.
- Enforce issuance, rotation, revocation, and usage monitoring via policy.
- Monitor anomalies: unusual key use, off‑hours access, atypical resource paths.
- Segregate customer data decryption keys from broader operational keys.
- Maintain tamper‑evident logs of key access and administrative actions.
3) Endpoint, EDR & DFIR Readiness
- Deploy EDR across all corporate endpoints (including macOS) with contain/quarantine controls.
- Enable full disk encryption (FileVault/BitLocker) with escrowed recovery keys.
- Pre‑stage forensic triage kits (memory capture, disk imaging) and playbooks.
- Use golden images and device enrollment tying serials to identities/MDM.
4) Logging, Telemetry & Retention
- Collect endpoint, identity/IAM, application/API, database, and network logs.
- Ensure centralized SIEM/SOAR ingestion with minimum 12–18 months retention for high‑risk systems.
- Protect logs with WORM/immutable storage and hash‑chain integrity.
- Instrument sensitive tables/objects with fine‑grained audit logging.
5) Data Minimization & Tokenization
- Reduce the sensitive data surface (don’t store building access codes if you don’t need them).
- Tokenize/encrypt high‑risk attributes; restrict clear‑text access by role and context.
- Implement privacy by design and data retention limits.
6) Insider Threat Program
- Baseline normal behavior with UEBA (User & Entity Behavior Analytics).
- Trigger enhanced monitoring upon employee exit, role change, or policy violations.
- Establish clear consequences and ethics training; reduce motive/opportunity.
7) Chain of Custody & Legal Defensibility
- Train responders on evidence handling, hashing, and custody forms.
- Segregate forensic copies; never analyze on originals without imaging.
- Document who, what, when, where, how for every evidence transfer.
- Coordinate with legal and privacy teams from day one.
Mapping to Standards & Frameworks
- NIST SP 800‑61 (Computer Security Incident Handling Guide): Incident lifecycle (Preparation, Detection & Analysis, Containment, Eradication & Recovery, Post‑Incident Activity).
- NIST SP 800‑86 (Guide to Integrating Forensic Techniques into IR): How to embed forensics into IR processes, tooling, and evidence management.
- ISO/IEC 27035 (Incident Management): Governance for planning, detection, reporting, and learning.
- ISO/IEC 27001 (ISMS) & Annex A Controls: A.5 (InfoSec policies), A.8 (Asset management), A.9 (Access control), A.12 (Ops security), A.18 (Compliance).
- MITRE ATT&CK: Relevant tactics in insider and post‑employment misuse often include Credential Access, Defense Evasion, Discovery, Collection, and Exfiltration.
- CMMC/PCI/GDPR/PIPA alignment: Ensure logging, least privilege, breach notification, data minimization, and encryption requirements are met.
Applying the Lessons: An Actionable Playbook
Within 30 days (quick wins):
- Key inventory & emergency rotation for high‑value data paths.
- EDR coverage gap analysis, ensure macOS endpoints are fully enrolled.
- SIEM log completeness audit (IAM, API, DB, DLP, EDR, MDM).
- Access review for privileged accounts; revoke stale rights; enable JIT.
- Offboarding checklist: access revocation, key retrieval/rotation, device return & imaging.
Within 90 days (programmatic improvements):
- Implement UEBA with baselines for sensitive data access.
- Roll out WORM/immutable logging for crown‑jewel systems.
- Formalize DFIR runbooks with evidence handling SOPs and custody templates.
- Add fine-grained DB audit and object‑level access telemetry.
- Conduct table‑top exercises with Legal, HR, Privacy, and Physical Security.
Within 180 days (strategic uplift):
- Adopt Zero Trust Architecture patterns (policy decision points, continuous verification).
- Rationalize key/secret management into a hardened, monitored service with segregation of duties.
- Integrate SOAR for automated containment (session revocation, key disablement, device quarantine).
- Certify against ISO/IEC 27001 controls relevant to IR, logging, and access.
- Measure and report MTTD/MTTR for insider‑related scenarios; drive quarterly improvements.
Tooling Landscape (Build vs. Buy)
- EDR/DFIR: triage acquisition, process trees, behavioral detections, isolation, live response.
- SIEM/SOAR: correlation, alerting, evidence orchestration, case management, playbook automation.
- KMS/HSM & Secrets Management: centralized issuance, rotation, and tamper‑evident logs.
- Identity & PAM: MFA enforcement, JIT elevation, session recording/approval.
- Data Security: DLP, tokenization, and field‑level encryption; data discovery & classification.
- UEBA: anomaly detection across identity, endpoint, and data access.
Practical tip: Before buying new tools, instrument what you have. Many clouds and EDRs expose audit logs that are not enabled by default or aren’t retained long enough to be useful.
Case‑Aligned Control Mapping (What Worked vs. What Was Missing)
What helped investigators:
- Device serial → account attribution and MDM/iCloud ties
- Recovered scripts and endpoint artifacts
- Forensic collection and chain‑of‑custody discipline
What likely reduced resilience:
- Key theft risk (issuance, storage, or revocation gaps)
- Over‑permissioned data access / insufficient least privilege
- Potential logging scope/retention or alerting gaps for abnormal key usage
- Data surface area (e.g., building access codes held alongside orders)
FAQs (Schema‑Friendly)
What is digital forensics in incident response?
Digital forensics is the process of preserving, analyzing, and presenting electronic evidence to support containment, eradication, recovery, and legal proceedings after a cyber incident.
Can destroyed devices still yield usable evidence?
Often, yes. Evidence exists in multiple places (cloud audit logs, identity systems, network telemetry) and residual data can be recovered from damaged storage. Serial numbers and account bindings aid attribution.
How do we prevent insider misuse of keys or credentials?
Use KMS/HSM, PAM, least privilege, JIT access, rigorous rotation/revocation, and monitoring for anomalous key usage. Back it with immutable logging and UEBA.
Which standards should we follow for forensic‑ready IR?
Start with NIST SP 800‑61 and 800‑86, ISO/IEC 27035, and ISO/IEC 27001 Annex A controls. Map detections and response to MITRE ATT&CK tactics.
How long should we retain logs?
Retain 12–18 months for high‑risk systems (or as required by regulation). Ensure integrity with WORM storage and hash‑chain methods so logs are court‑defensible.
Does Zero Trust help with insider threats?
Yes. Continuous verification, context‑aware policy, and least privilege limit what insiders (or their compromised sessions) can access and detect anomalies faster.
Conclusion
The Coupang incident underscores a hard truth: destroying hardware doesn’t erase accountability. When insider misuse intersects with key governance gaps and insufficient telemetry, organizations face huge financial, regulatory, and trust consequences. The countermeasures are well known—digital forensics‑ready IR, Zero Trust, strong key/secret management, immutable logging, and a mature insider threat program.
If you’re a CISO, SOC lead, or DevOps/IT owner, now is the time to validate your forensic readiness, tighten key controls, and exercise your playbooks—before you need them.
