Coupang Faces US Lawsuits After Massive Data Breach

Coupang is facing legal action not only in Korea but also in the United States following its massive data breach incident. Coupang Inc (CPNG), the parent company listed on the New York Stock Exchange, has seen its stock price decline due to the incident. US regulatory authorities may also intervene, intensifying pressure on the e-commerce giant.

According to industry sources on Wednesday, DJS Law Group, based in New York, has begun recruiting shareholders who suffered losses from Coupang's customer data breach. "We are reviewing whether the company made misleading statements or failed to disclose material information to investors," the law firm said. "Coupang's stock dropped more than 5% as Korean police investigate potential technical vulnerabilities at the e-commerce giant, which suffered the worst data breach incident."

Coupang announced on December 29 that personal information of 33.7 million customers had been leaked. On January 2 (local time), the first US trading day after the announcement, Coupang's stock closed at $26.65, down 5.36%. The intraday decline exceeded 7%. The stock rebounded only 0.23% the following day, and sluggish trading continued as the incident expanded. The closing price on January 6 was $27.11, about 20% below its 52-week high of $34.08.

Despite the record-breaking data breach, Coupang has been passive in issuing apologies and announcing preventive measures. The company has not yet filed a disclosure about the incident with the US Securities and Exchange Commission. Under SEC regulations, companies listed on US exchanges must file a disclosure within four business days after determining a security incident is "material." This contrasts with Coupang's action on Wednesday to repost an apology and notice on its mobile application and website, changing the wording from data "exposure" to data "leak" as directed by Korea's Personal Information Protection Commission.

Industry observers believe Coupang is conducting an extended legal review on the "materiality" of the incident. The company appears to be comprehensively considering potential legal disputes, stock price impact, and the scale of customer attrition. JP Morgan's assessment that potential customer attrition would be limited despite the incident also appears to be a factor. Coupang has established a de facto monopoly in Korea's e-commerce market through its Rocket Delivery service and membership subscription benefits.

Legal action against Coupang is already materializing in Korea. Law firm Cheong filed the first damages lawsuit against Coupang at Seoul Central District Court on behalf of 14 users. Dozens of online communities related to class action lawsuits against Coupang have been established on Naver alone, with some cafes having up to 150,000 members.

Law firm Daeryun filed a complaint against Coupang CEO Park Dae-jun and company officials responsible for personal information certification, alleging violations of the Personal Information Protection Act and breach of fiduciary duty. Daeryun is also reviewing a US class action lawsuit against Coupang's headquarters in coordination with SJKP LLP, its affiliated firm in New York.

"Coupang initially apologized for data 'exposure' and quickly took down the apology notice, which further eroded consumer trust," an industry official said. "Pressure on Coupang from the government, politicians, and other quarters is likely to intensify for some time."