Coupang's cyber saga may come back to sting

Alibaba Holding

Mon 13:00

The author is a Reuters Breakingviews columnist.  The opinions expressed are her own.
By Katrina Hamlin

    HONG KONG, June 15 (Reuters Breakingviews) - Coupang CPNG.N is not out of the woods yet. The New York-listed e-commerce giant's shares rose 14% after South Korean regulators issued a record fine against the company's local subsidiary. The reaction seems to draw a line under a months-long saga triggered by a massive cybersecurity breach disclosed in November. But that may be premature.
The country's Personal Information Protection Commission concluded that Coupang had leaked personal data of more than 33 million customers and failed to detect the breach within the 72 hours required by law. The fines, totalling $410 million, are roughly double the listed parent company's 2025 net profit. But the financial damage could have been worse: Korean law allows regulators to levy a charge of as much as 3% of revenue, which would have amounted to more than twice the final sum if authorities based their calculations on the group's sales.
Coupang will appeal. But other regulatory hurdles remain. In April, Korea's anti-trust watchdog, the Fair Trade Commission, designated founder and CEO Bom Kim the de facto controlling entity of Coupang. That effectively means the U.S.-listed and U.S.-headquartered Coupang will be treated the same as South Korea's family-run conglomerates like Samsung Electronics 005930.KS and be subject to additional regulations on everything from intra-family transactions to more stringent disclosures.
The company is also challenging this decision, and a hearing is expected on June 16. To complicate matters further, Coupang's U.S. investors may even revive efforts to petition officials in Washington to initiate a so-called Section 301 investigation on unfair trade practices against the government in Seoul. Already, U.S. Vice President JD Vance has waded in on the issue. Moreover, Kim has other powerful allies stateside, including Federal Reserve Chair Kevin Warsh, who served on Coupang's board from 2019 to earlier this year.
Regardless of the fallout, this will further strain relations between the company and South Korean regulators and politicians. At best, it's an unnecessary distraction at a potentially vulnerable time: active customers grew just 2% year-on-year in the quarter ending March, to 23.9 million users, a slowdown from last year's 10% rise. Challengers in South Korea, where Coupang made more than 90% of its total revenue last year, range from China's Alibaba 9988.HK and domestic tech conglomerate Naver 035420.KS, while traditional retail groups including Lotte Shopping 023530.KS and Shinsegae 004170.KS are circling.
All of that makes it harder for shares – languishing 40% below their pre-crisis levels – to fully recover. Coupang's cyberattack still stings.
Follow Katrina Hamlin on Bluesky and LinkedIn.
     
CONTEXT NEWS
South Korea will fine e-commerce giant Coupang $410 million following a cyber breach that led to the leak of ‌customer information last year and illegal collection of personal information, according to a filing on June 11. The fine includes $278 million relating to the 2025 incident, plus a further $132 million fine in connection with the collection and storage of data for a third-party advertising program. The combined fines are equivalent to roughly twice the group’s net profit last year.
The Personal Information Protection Commission said in a briefing on June 11 that the New York-listed company had leaked personal data of more than 33 million customers and failed to detect the breach within the 72 hours required by the law.
The company said in an emailed statement that "we regret that our proactive measures to prevent secondary harm from last year's data leak incident, as well as our explanations based on clear facts, were not sufficiently reflected" in the regulator's decision.
Coupang’s New York-listed shares rose 14.1% to $17.25 on June 11.

(Editing by Robyn Mak; Production by Aditya Srivastav)
((For previous columns by the author, Reuters customers can click on HAMLIN/katrina.hamlin@thomsonreuters.com; Reuters Messaging: katrina.hamlin.thomsonreuters.com@reuters.net))