Coupang ($CPNG) Cybersecurity Breach, Regulatory Fallout, and CEO Resignation Case
$CPNG investors filed a claim against Coupang for failing to disclose a prolonged cybersecurity breach that exposed data from over 33 million customer accounts, as well as the company’s inadequate internal controls and delayed reporting to regulators.
After the breach became public and South Korean authorities began investigations, $CPNG fell 21% from $28.70 on November 29, 2025, to $22.72 by December 17, 2025.
$CPNG investors can join this case to be notified about potential recovery.
Between August 6, 2025, and December 16, 2025, Coupang assured investors that its cybersecurity systems were robust, citing compliance with data protection laws like Korea’s PIPA and highlighting encryption, monitoring, and response protocols. In its quarterly reports, the company stated that any breaches would be disclosed and addressed in a timely and lawful manner.
In reality, Coupang had experienced a major security incident beginning in May 2025, when a former employee retained unauthorized access to internal systems and exposed sensitive customer data, including names, emails, and delivery addresses. This breach remained undetected for months and was not disclosed to investors or regulators until mid-December, despite SEC rules requiring prompt notification of material cybersecurity incidents.
The breach eventually became public through media reports on November 30, 2025, prompting public backlash, a CEO resignation from Coupang’s Korean unit, and police raids. South Korean regulators launched formal investigations, and lawmakers began pushing for new legislation in response to the severity of the incident.
Following the news cycle between December 1 and December 17, 2025, $CPNG fell from $28.70 to $22.72, with declines driven by investor concerns over reputational damage, legal exposure, and governance failures.
It failed to prevent or detect unauthorized access to customer data for over six months.
it did not timely disclose a material cybersecurity breach in violation of SEC reporting rules.
It misrepresented the strength of its internal cybersecurity controls and regulatory compliance.
Investors argue Coupang misled the market about its data security and compliance capabilities, leading to significant losses once the truth emerged.