Coupang Class Action Lawsuit: Securities Fraud, Data Breach Losses, and Recovery Options

To protect the rights of millions of shareholders and consumers, the court must certify the class under Federal Rule of Civil Procedure 23. This is not an automatic process; the court must find that the case is suitable for a group effort based on several forensic criteria:

• Numerosity: 
• The group of people affected (over 33 million accounts and thousands of investors) is so large that it would be impossible for everyone to sue individually.
• Commonality:
• There must be shared legal questions, such as: "Did Coupang’s failure to revoke a former employee’s security keys constitute gross negligence?"
• Typicality: 
• The claims of the "Lead Plaintiffs" (currently represented by individuals surnamed Lee and Park in the EDNY filing) must be typical of what everyone else experienced.
• Adequacy: 
• The lawyers leading the case must prove they have the resources and expertise to win against a global giant like Coupang.

The centerpiece of this litigation is Section 10(b) of the Securities Exchange Act and Rule 10b-5, which prohibit any act or omission resulting in fraud or deceit in connection with the purchase or sale of any security. Section 10(b) and Rule 10b-5 prohibit material misstatements or omissions, and the plaintiffs argue that Coupang’s repeated assurances of "proactive security" were functionally fraudulent. The discovery that a former employee retained "master keys" to Coupang’s internal systems for nearly six months suggests that the company’s public statements were not just mistaken, but intentionally misleading.

A primary focus of the SEC scrutiny in early 2026 is Coupang’s failure to adhere to the "four-day rule." Under SEC Form 8-K Item 1.05, public companies must disclose a material cybersecurity incident within four business days of determining its materiality.

• The Determination Date: 
• Forensic logs and internal testimonies suggest Coupang’s leadership determined the breach was "material" (significant enough to impact investors) as early as November 18, 2025.
•  
• The Disclosure Delay: 
• The formal 8-K filing was not made until December 16, 2025, a delay of 11 business days beyond the legal limit. The Plaintiffs argue that this delay was a calculated omission. This "disclosure gap" allowed the company to manage the "burn rate" of its stock price while insiders possessed material, non-public information - a classic foundation for a securities fraud claim.

The lawsuit alleges that Coupang suffered from a "material weakness" in its Internal Control Over Financial Reporting (ICFR). If a company cannot track who has access to its databases, it cannot verify the integrity of its financial data. Under the Sarbanes-Oxley Act (SOX), companies must have strict "IT General Controls" (ITGC). The fact that a former employee had unrevoked authentication keys is a terminal violation of these standards, suggesting that Coupang’s prior SOX certifications were effectively false.

The Class Period is the specific window of time when the fraud was supposedly happening.

• Start Date: May 7, 2025 (When Coupang first issued reports touting its "advanced security").
• End Date: December 16, 2025 (When the final 8-K admitted the full scope of the breach). Who qualifies for the Coupang class action? Any investor who purchased or acquired Coupang, Inc. (CPNG) common stock during this window may be eligible to participate in the recovery of securities fraud losses.

Under the Dura Pharmaceuticals standard, you must prove that the "truth" coming out actually caused the price to drop. The Coupang truth came out in stages, each causing a fresh wave of losses:

• November 30, 2025: Reuters first reports the 33.7 million account breach; the stock begins to slide as the $8 billion market cap loss initiates.
• December 10, 2025: High-level executive resignations signal internal turmoil, causing a secondary drop.
• December 16, 2025: Formal 8-K filing confirms the breach, providing the first "official" forensic admission.
• February 5, 2026: A new Reuters report reveals an additional 165,000 leaks and alleges that Interim CEO Harold Rogers may have committed perjury regarding government instructions.
• The Reaction: Shares plummet another 13% in a single session, creating a new "correction point" for those who held the stock through early 2026.

Under Section 20(a) of the Exchange Act, a person who "controls" an entity liable for fraud is also personally liable. The suit argues that Kim had "actual control" over the company's cybersecurity policies and budget.

• The Diversion of Funds: 
• Plaintiffs allege that Kim prioritized market expansion (such as the Farfetch acquisition) over the implementation of necessary "kill switches" for authentication keys.
• The Knowledge of Risk: 
• Internal memos reportedly showed that security teams warned about the unrevoked keys months before the breach, yet these warnings were allegedly ignored at the executive level.

Under SOX Section 302 and 404, the CEO must personally certify that internal controls are effective. If Bom Kim signed these certifications while knowing that security keys were unrevoked, he faces severe regulatory scrutiny. The ongoing 14-hour police questioning of interim leadership in Seoul regarding "perjury" and "destruction of evidence" further bolsters the U.S. Claim that the "tone at the top" was one of obfuscation rather than compliance.

• For Investors: Did you buy CPNG stock between May 7 and December 16, 2025?
• For Consumers: Did you receive a notification that your data (name, phone, address, or entrance code) was part of the 33.7 million or 165,000 records leaked?

If you suffered a "substantial" loss (typically over $100,000 for investors), you have a legal right to petition the court to be the Lead Plaintiff. This deadline is absolute. Being a Lead Plaintiff allows you to:

• Select the lead counsel for the entire class.
• Direct the litigation and settlement strategy.
• Ensure that the final agreement includes punitive damages and systemic changes to Coupang’s security.

Because Coupang is a U.S.-listed company with its core operations in Korea, you need a legal team that understands both jurisdictions. SJKP LLP, in collaboration with the forensic and media teams at Daeryun, provides a "Global Litigation Infrastructure." We bridge the gap between Korean regulatory findings (like the PIPC investigations) and U.S. Federal court liability.

To perform a surgical review of your position in the Coupang class action, please prepare the following for our initial audit:

• Trade Confirmations: Detailed logs of CPNG purchases/sales during the Class Period.
• Account Compromise Notice: Any emails or texts from Coupang regarding the 2025-2026 breach.
• Loss Calculation: A forensic summary of realized and unrealized losses through February 9, 2026.
• Evidence of Reliance: Any IR materials or "Security Guarantee" statements you relied on when buying the stock.