Coupang is confronting a major legal challenge in the United States after a massive data breach affected over 33 million users. The incident has prompted a US-based law firm representing Korean victims to prepare a class-action lawsuit seeking punitive damages.
SJKP, a New York office of Daeryun law firm, said Monday it is gathering victims to file the lawsuit against Coupang Inc. in federal court. The firm has already secured more than 200 plaintiffs and aims to reach 1,000 by year-end.
Kim Kuk-il, managing partner at Daeryun, said the US case is separate from ongoing lawsuits in South Korea. He emphasized that it focuses on governance failures and filing obligations, not solely on consumer compensation.
The data breach, disclosed on November 29, exposed personal information of approximately 33.7 million users. The leaked data included names, phone numbers, addresses, emails, and recent purchase histories.
Coupang has not filed the required report with the U.S. Securities and Exchange Commission, despite rules mandating notification within four business days. Kim stressed that the breach affected users worldwide, making the US court a proper venue for legal action.
He added that access to Coupang’s US headquarters could force disclosure of data held in Korea or elsewhere. Legal experts note that previous US cases, including Equifax and Facebook, resulted in settlements of $425 million and $725 million, respectively.
Meanwhile, Seoul police raided Coupang’s Korean headquarters to gather evidence on the breach. Analysts cited the company’s ownership and governance structure as a factor in oversight failures.
Coupang Inc., headquartered in Delaware, controls multiple subsidiaries including Korean Coupang and Coupang USA. CEO Bom Kim holds voting power equivalent to roughly 74 percent, giving him near-total control over corporate decisions.
SquareWell Partners, a shareholder advisory firm, warned that the lack of oversight may have contributed to the breach. The firm suggested institutional investors could pressure key directors, including Kim, at the 2026 annual meeting.
Tal Hirshberg, an associate at SJKP, said the lawsuit aims to determine if Coupang headquarters exercised decision-making authority over data security and IT infrastructure.
The data breach lawsuit underscores the importance of corporate accountability, governance, and investor scrutiny in global technology firms.
