Home > Business > Industry

Coupang to face class action suit in U.S. over data breach

Published: 09 Dec. 2025, 16:17 Updated: 17 Dec. 2025, 13:58

Coupang's headqarters in Songpa District, central Seoul, on Dec. 9 [NEWS1]

A class action lawsuit is set to be filed in the United States against Seattle-based Coupang over a data breach that affected more than 33.7 million users.

SJKP Law Firm, the U.S. branch of the Korean Daeryun Law Firm, announced at a press conference in its Manhattan office on Monday that it will formally file a consumer class action lawsuit with a U.S. federal court in New York.

“[Seattle-based] Coupang is incorporated in the state of Delaware and is listed on the New York Stock Exchange as an American company,” said Kim Kuk-il, the managing partner of Daeryun. “We will use [...] the American judicial system to uncover the full truth [behind the leak] and ensure that victims receive meaningful compensation.”

Coupang’s annual revenue surpassed 40 trillion won ($27.19 billion) last year and is expected to reach 50 trillion won this year. About 90 percent of its revenue is generated from the Korean market. However, the company’s Korean operations are fully owned by Seattle-based Coupang.

Coupang CEO Park Dae-jun has claimed responsibility for the breach. Seattle-based Coupang Chairman Bom Kim, a U.S. citizen, has distanced himself from the incident, stating that he has stepped back from day-to-day management. Yet U.S. financial filings describe him as “the chief decision-maker for the Korean business.”

“This lawsuit will fundamentally differ from the Korean legal actions, which focus on consumer damages,” Kim Kuk-il of Daeryun said. “The U.S. case will address failures in corporate governance and violations of disclosure obligations by a listed company. The American case will proceed independently from the Korean lawsuits.”

Kim Kuk-il, the managing partner of Daeryun Law Firm, speaks during a press conference, announcing a class action lawsuit against Seattle-based Coupang at the law firm's New York office in Manhattan on Dec. 8. [NEWS1]

Tal Hirschberg, an attorney with SJKP, said the key issue in the lawsuit will be proving that Seattle-based Coupang was not merely a holding company but exercised real decision-making authority in core areas such as data security, personal information protection and IT infrastructure investments.

Hirschberg said that his firm intends to use the U.S. discovery process to compel Seattle-based Coupang to submit relevant internal documents.

Roughly 200 plaintiffs involved in the Korean lawsuits have also joined the U.S. action. Daeryun plans to officially file the case in U.S. court by the end of the year, with additional plaintiffs expected.

In the United States, where punitive damages are allowed, the total compensation can vary significantly depending on the severity of corporate negligence.

In 2021, U.S. telecom giant T-Mobile suffered a data breach that affected more than 76.6 million current, former and potential customers. The company agreed to pay $350 million in settlement payments and promised to invest at least $150 million to improve its cybersecurity.

In another case, Equifax, a major U.S. credit reporting agency, experienced a breach in 2017 that exposed the credit information of 143 million Americans — over half the adult population at the time. The company eventually agreed to pay up to $700 million in settlements to the Federal Trade Commission.

Seattle-based Coupang Chairman Bom Kim, left, poses for a photo with Donald Trump Jr. during a reception in Washington on Jan. 19. [YONHAP]

Attorney Lee Joong-bae of Nelson Mullins, a large law firm based in Washington, told the JoongAng Ilbo that because Seattle-based Coupang is listed in the United States, “it clearly falls under U.S. court jurisdiction.”

“Data protection is a far more sensitive issue in the United States than in Korea,” Lee added. “Although [the lawsuit] may take time, if [Seattle-based Coupang] lacked adequate safeguards or attempted to intentionally avoid responsibility, it could meet the criteria for punitive damages.”

This article was originally written in Korean and translated by a bilingual reporter with the help of generative AI tools. It was then edited by a native English-speaking editor. All AI-assisted translations are reviewed and refined by our newsroom.
BY KANG TAE-HWA [[email protected]]