The appearance of Coupang&#39;s headquarters in Songpa-gu, Seoul. 2025.12.29 / News1

Coupang Faces Class Action Lawsuit in U.S. Over Data Breach Claims

South Korean shareholders of Coupang have filed their first class action lawsuit in a U.S. court, alleging trillions of KRW in losses due to stock price drops following a data breach scandal. The case not only seeks substantial damages but also raises questions about potential action by the U.S. Securities and Exchange Commission (SEC) against Coupang.

On Tuesday, We The People Law Firm filed a class action suit in the U.S. District Court for the Western District of Washington. The defendants include Coupang Inc., its Korean subsidiary Coupang Corp., and key executives such as Chairman Kim Beom-seok, Chief Financial Officer (CFO) Gaurav Anand, and Chief Information Security Officer (CISO) Brett Mathis.

This lawsuit marks the first time domestic Coupang shareholders have pursued collective damages in a U.S. court. While numerous consumer class actions related to the data breach are ongoing, this case is one of only two known securities class actions by Coupang shareholders, the other being filed on December 20 in the Northern District of California by U.S. investors.

The complaint, obtained by <em>News1</em>, represents all investors who acquired Coupang common stock between May 7 and December 16, 2025. It alleges violations of U.S. federal securities laws, arguing that Coupang should compensate shareholders for unfair losses stemming from the stock's sharp decline after the data breach revelation.

Plaintiffs contend that Coupang's false and inadequate disclosures led to substantial shareholder losses. They argue that the company, either intentionally or negligently, failed to disclose critical information to shareholders even before the data breach incident occurred.

Following the November 29 announcement of the data breach, Coupang's stock plummeted 5.36% on December 1, the first U.S. trading day after the news. This single-day drop resulted in an estimated loss of 3.8 trillion KRW (approximately 2.61 billion USD). The stock continued its downward trend, falling a total of 10.56% by December 16.

We The People anticipates that the lawsuit could involve claims in the trillions of KRW, given that all shareholders who purchased Coupang stock during the specified period qualify as plaintiffs. As of the filing date, Coupang's market capitalization was 43 billion USD, with estimated losses exceeding 6 trillion KRW (approximately 4.14 billion USD) due to the stock's decline.

The lawsuit is expected to focus on Coupang's alleged false disclosures, inadequate reporting, and significant omissions in violation of disclosure obligations.

Plaintiffs argue that Coupang failed to disclose the data breach to the SEC within the required four business days after becoming aware of it on November 16. They also point to Coupang's February business report, which allegedly falsely stated there was no significant impact from cybersecurity threats.

There's growing speculation that this lawsuit could trigger SEC involvement. The SEC considers incidents that damage a company's reputation and customer trust due to cybersecurity disclosure failures as significant incidents. Coupang's alleged failure to disclose key information within four business days and inadequate reporting could potentially lead to SEC prosecution of Coupang's U.S. headquarters.

If the allegations are proven true, the SEC could impose substantial fines on Coupang for misleading disclosures and other deceptive practices, potentially resulting in astronomical penalties.

Attorney Lee Young-ki of We The People Law Firm stated that while the damages amount to trillions of KRW, fines paid to the government don't effectively remedy the actual harm to shareholders. To prevent such incidents from recurring, it needs compensation that serves as a real deterrent.

Coupang Faces Class Action Lawsuit in U.S. Over Data Breach ClaimsSouth Korean shareholder …

Domestic Shareholders File First U.S. Class Action Against Coupang... Targets "False Disclosure"