Coupang’s data breach starts drawing US legal attention

A gigantic banner bearing the name of Korean e-commerce giant Coupang is displayed on the building of the New York Stock Exchange on Mar. 11, 2021 to mark its debut on the U.S. stock market. Korea Times file

SEATTLE — Coupang may be heading into a new phase of legal pressure in the U.S. as investors begin to assess the fallout from the massive data breach that exposed personal information linked to more than 33 million customer accounts. The breach has already drawn intense scrutiny in Korea and contributed to a decline in Coupang’s share price.

A New York–based investor rights firm, DJS Law Group, has opened an investigation into whether Coupang may have made misleading statements or failed to disclose information related to cybersecurity risks that could be important to investors. Such inquiries are often a precursor to a class action lawsuit.

"The investigation focuses on whether the company issued misleading statements and/or failed to disclose information pertinent to investors," DJS Law Group said in a statement, Tuesday.

U.S. litigation firms commonly monitor major data incidents and sharp stock moves for signs that a company failed to properly warn investors about known vulnerabilities. Coupang’s share price movement following the breach disclosure suggests conditions that could prompt legal action.

Coupang has faced legal scrutiny in the U.S. before. A shareholder lawsuit tied to its 2021 IPO was dismissed with prejudice by a federal court in September 2025 after the judge found that challenged statements were not materially misleading.

A separate whistle-blower retaliation suit, in which a former employee alleged he was dismissed after raising compliance concerns, is still pending after a judge declined to dismiss the claim earlier this year.

Legal observers say additional matters could remain confidential until formally filed.

If a new lawsuit proceeds, cases of this type often move slowly. Securities class actions can take two to five years, and if a settlement is reached, shareholder compensation often takes more than a year to distribute.

DJS Law Group did not immediately respond to a request for comment from The Korea Times.

For now, U.S. legal activity remains limited, but as the breach continues to unfold in Korea, pressure from investors and regulators in the United States may increasingly demand answers as well.