SEOUL – Coupang, South Korea’s e-commerce giant, is facing mounting criticism over a significant security flaw in its proprietary shipping labels. While the company has long been praised for its "Rocket Delivery" efficiency, a recent investigation reveals that QR codes printed on its packaging expose sensitive customer information in unencrypted "plaintext," accessible to anyone with a smartphone.
The Digital Loophole
According to industry reports on March 8, 2026, Coupang utilizes a dual-labeling system featuring both traditional 1D barcodes and 2D QR codes. These are intended as a redundancy measure; if a barcode is smudged or the network fails during the sorting process, workers can scan the QR code to ensure the package reaches its destination.
However, unlike the primary shipping stickers that customers can peel off, these QR codes are often printed directly onto the cardboard boxes or plastic "Signal Bag" mailers. When scanned using a standard smartphone camera—without any specialized logistics software or authentication—the codes immediately display the recipient's full delivery address, apartment number, and a partially masked name.
A Goldmine for "Stalking and Phishing"
The security risk stems from the physical lifecycle of a package. Delivery boxes often sit in unguarded hallways or communal recycling centers for hours. Even if a diligent customer peels off the main address label before discarding the packaging, the QR code remains embedded on the box.
"This is a structural defect in privacy design," noted an industry analyst. "Anyone walking through a residential complex can scan discarded packaging to harvest a database of resident names and exact home addresses. In the wrong hands, this data is fuel for stalking, voice phishing, or targeted home invasions."
Regulatory Pressure and Corporate Response
The Personal Information Protection Commission (PIPC) of Korea has previously recommended that logistics companies make labels easy to destroy and standardize masking techniques. While Coupang includes a small disclaimer advising customers to "destroy the shipping label," the permanence of the QR code makes total destruction difficult for the average consumer.
In response to the growing concerns, Coupang has reportedly begun exploring measures to encrypt the data within the QR codes or transition to a format that requires authorized handheld terminals to decode. For now, experts urge consumers to not only peel off stickers but to physically deface or black out any printed QR codes before disposal.
[Copyright (c) Global Economic Times. All Rights Reserved.]
