Coupang's market dominance remains unshaken after data breach: analysts

Coupang delivery vehicles are parked at a logistics center in Seoul, Monday. Yonhap

Coupang's massive data breach is expected to have only a limited impact on the number of customers leaving the platform, due to the company's dominant position and differentiated services, analysts said Wednesday.

The breach, which exposed the personal information of 33.7 million users, is the largest in Korean history. It reportedly occurred five months ago due to a former employee, but remained undetected until recently.

Coupang shares dropped 5.36 percent on Monday (local time) following reports of the breach over the weekend. The stock, however, rebounded slightly on Tuesday, rising 0.23 percent to close at $26.71 in New York trading.

Despite the negative headlines, Coupang's domestic rivals saw modest gains or remained largely unaffected.

From Monday to Wednesday, Naver shares climbed 1.44 percent to 246,500 won ($167.85). Naver operates e-commerce platforms, including Naver Store and Naver Pay. Emart and Lotte Shopping also advanced 4 percent and 3.1 percent, respectively, while the benchmark KOSPI index added 2.96 percent.

Coupang controlled 22.7 percent of Korea's e-commerce market by revenue last year, ahead of Naver at 20.7 percent, Gmarket and Auction at 8 percent, and SSG.com at 3 percent.

Analysts say the company's flagship services — such as Rocket Delivery, a free next-day delivery service, and Coupang Play, a streaming platform — provide enough value to limit customers from leaving the platform. Even if some users do depart, rivals may see little benefit, as consumers consider competing platforms similarly vulnerable to data breaches.

"We expect potential customer losses to be limited due to CPNG's (stock ticker symbol for Coupang) unrivaled market positioning and Korean customers being seemingly less sensitive to data breach issues," J.P. Morgan analysts wrote in a note Monday.

Park Seyon of Morgan Stanley and Cho Ahyung of Bank of America Securities also reiterated buy ratings on Coupang on Sunday and Monday, respectively, according to investment research platform TipRanks. Their price targets remain $35 and $38.

J.P. Morgan analysts said the breach is likely to result in temporary reputational damage and potential one-off costs, including customer compensation or regulatory fines.

Those risks are growing, as consumers prepare a class-action lawsuit and the government signals that significant penalties are imminent. Under the Korean law, companies can be fined up to 3 percent of their total revenue for data protection violations. With Coupang reporting 41 trillion won in revenue last year, penalties could exceed 1.2 trillion won.

The company may also face scrutiny in the U.S. as Coupang has not disclosed the breach to the Securities and Exchange Commission, despite listing on the Nasdaq. U.S. regulations require public companies to report "material cybersecurity incidents" within four business days.

"The damage is massive, at roughly 34 million cases, but even more startling is the fact that the company did not realize the breach had occurred for five months," President Lee Jae Myung said at a Cabinet meeting Tuesday. He called for tougher penalties and a more practical punitive damages system.