Coupang ($CPNG) Cybersecurity Breach, Regulatory Fallout, and CEO Resignation Case

N.D. California

Court

3:25-cv-10795

Case number

08/06/2025

Class period Start

12/16/2025

Class period End

02/16/2026

Lead Plaintiff motion deadline

$CPNG investors filed a claim against Coupang for failing to disclose a prolonged cybersecurity breach that exposed data from over 33 million customer accounts, as well as the company’s inadequate internal controls and delayed reporting to regulators.
After the breach became public and South Korean authorities began investigations, $CPNG fell 21% from $28.70 on November 29, 2025, to $22.72 by December 17, 2025.
$CPNG investors can join this case to be notified about potential recovery.
Case Details:

Between August 6, 2025, and December 16, 2025, Coupang assured investors that its cybersecurity systems were robust, citing compliance with data protection laws like Korea’s PIPA and highlighting encryption, monitoring, and response protocols. In its quarterly reports, the company stated that any breaches would be disclosed and addressed in a timely and lawful manner.

In reality, Coupang had experienced a major security incident beginning in May 2025, when a former employee retained unauthorized access to internal systems and exposed sensitive customer data, including names, emails, and delivery addresses. This breach remained undetected for months and was not disclosed to investors or regulators until mid-December, despite SEC rules requiring prompt notification of material cybersecurity incidents.

The breach eventually became public through media reports on November 30, 2025, prompting public backlash, a CEO resignation from Coupang’s Korean unit, and police raids. South Korean regulators launched formal investigations, and lawmakers began pushing for new legislation in response to the severity of the incident.

Following the news cycle between December 1 and December 17, 2025, $CPNG fell from $28.70 to $22.72, with declines driven by investor concerns over reputational damage, legal exposure, and governance failures.

Based on these events, $CPNG investors filed a claim against Coupang, alleging the company:
It failed to prevent or detect unauthorized access to customer data for over six months.
it did not timely disclose a material cybersecurity breach in violation of SEC reporting rules.
It misrepresented the strength of its internal cybersecurity controls and regulatory compliance.
Investors argue Coupang misled the market about its data security and compliance capabilities, leading to significant losses once the truth emerged.

Case Type

US Securities Class Action

Case Status

Lead Plaintiff Appointment

Alleged Offence

Misleading Statements,

Failure to Disclose

Suspected Party

Directors,

Management

Security Type

Stocks

Trade Direction

Long

Shock Event Date

11/30/2025

Filing date

12/18/2025

Lead Plaintiff Deadline

02/16/2026

Trusted by industry leaders

Endorsed by top professionals who trust our innovative solutions to drive impactful results.