Data breach prompts Coupang $1.2 billion payout

Coupang disclosed the results of its internal investigation into a personal data breach to the U.S. Securities and Exchange Commission on Dec. 29. The company made the disclosure in the United States without prior consultation with South Korean authorities, a move that has sparked controversy. The filing said about 3,000 user accounts were affected and outlined a consumer compensation plan totaling $1.2 billion, but it made no reference to objections or differing views raised by South Korean regulators.

The company submitted the investigation findings and compensation plan through EDGAR, the SEC’s electronic disclosure system. Coupang said the filing was intended to inform investors of potential financial impacts stemming from the anticipated large-scale compensation. According to the disclosure, Coupang plans to begin its compensation program on Jan. 15, issuing $1.2 billion worth of coupons to customers who were notified of the breach late last month.

Coupang said the identity of the perpetrator has been confirmed and that the individual is cooperating with both the company and investigative authorities. All devices used in the breach have been turned over. The filing stated that although roughly 33 million accounts were accessed, data from only about 3,000 users were actually stored by the perpetrator. It also said the leaked information was deleted before it could be shared with any third parties.

In line with a rebuttal statement issued Dec. 26, Coupang said the investigation was conducted over several weeks under direct guidance from the South Korean government. The company said that, following government recommendations, officials contacted the perpetrator, obtained a confession, and recovered the relevant devices.

South Korean authorities, however, raised strong objections immediately after Coupang released its internal findings on Dec. 25. The Ministry of Science and ICT said at the time, “The information announced by Coupang has not been confirmed by the joint public-private investigation team.” The Seoul Metropolitan Police Agency also said it would thoroughly verify the facts. None of these positions were reflected in the SEC filing.

Analysts warned that Coupang’s disclosure could draw criticism for incomplete reporting. While the filing’s “Forward-Looking Statements” section noted that investigation results could change, it did not disclose that regulators, including the South Korean government, were questioning the credibility of the findings, a factor that could affect the company’s operations.

Despite the friction with South Korean authorities, Coupang’s decision to proceed with the U.S. disclosure is widely viewed as a precautionary step under U.S. securities law. Delays in reporting material information could be deemed a serious violation and potentially weaken the company’s position in shareholder lawsuits and other legal proceedings.


김보라기자 purple@donga.com