Coupang Faces Growing Legal Challenges as Cybersecurity Class Period Grows

Coupang, a major player in the South Korean e-commerce scene, is facing an intensified legal battle that has recently taken a substantial turn, adding layers of complexity to its ongoing lawsuits. These legal challenges have shifted from initial labor disputes to a more severe cybersecurity failure, with a significant extension of the class period announced in early January 2026. The widened scope now includes investors who acquired shares between May 7, 2025, and December 16, 2025. This expansion illuminates a mounting crisis for Coupang as it confronts allegations of internal control breakdowns and delayed disclosures concerning a data breach that exposed millions of customer accounts.

For Coupang, the implications are far-reaching. The company now faces heightened financial liabilities and a renewed erosion of investor trust. Legal counsel has pushed the inception of the class period back to May 2025, putting earlier quarterly reports under scrutiny and asserting that the company’s risk management and data security claims were deceiving well before the breach was officially disclosed. This extended period presents a crucial opportunity for shareholders who suffered losses amidst the stock’s turbulence in the latter part of 2025, providing a broader avenue for seeking compensatory measures.

This legal shift represents a departure from past litigation focused on the company’s 2021 Initial Public Offering (IPO), which mostly pertained to undisclosed labor practices, workplace safety concerns, and allegations of anticompetitive conduct. However, that case was concluded in September 2025, dismissed by Judge Vernon S. Broderick, marking a temporary relief for Coupang, albeit short-lived. The spotlight has since turned to a catastrophic cybersecurity breach impacting approximately 33.7 million customer accounts in South Korea, where a former employee allegedly sustained unauthorized access to sensitive customer data for nearly six months, starting in June 2025.

Coupang’s delayed response to this breach further exacerbated the situation, with the company failing to promptly inform the Securities and Exchange Commission (SEC) until December 16, 2025, well beyond the regulatory reporting deadline. This expanded class period, now beginning in May 2025, seeks to capture the aftermath of Coupang’s Q1 2025 earnings report and the subsequent failure to detect and address critical data breach risks. The fallout from the delayed disclosure was swift, with shares plummeting as investors questioned the company’s oversight and governance.

In the aftermath of these developments, institutional and retail investors who entered during the 2025 rally, only to witness substantial losses following the disclosure, stand to benefit from the expanded class period. Conversely, Coupang faces both direct legal costs and potential damages, along with a pervasive “uncertainty premium” that could weigh on its stock performance in the foreseeable future. This mounting legal pressure exposes the company to reputational harm and operational scrutiny, potentially impacting its positioning within the competitive e-commerce landscape.

While the litigation directly involves Coupang and various law firms specializing in securities litigation, rivals such as Sea Limited and Amazon.com could indirectly benefit from any erosion in consumer trust or investor confidence in Coupang, potentially leading to market share redistribution within the sector. The case also underscores the importance of regulatory oversight and compliance, particularly in the realm of cybersecurity disclosures, serving as a cautionary tale for companies and investors alike.

As the litigation unfolds, Coupang’s logistics and third-party partners face a growing sense of uncertainty, with potential implications for planned expansions and profit margins. Regulatory bodies in both the U.S. and South Korea are closely monitoring this case, underscoring the importance of strict adherence to cybersecurity disclosure rules. This ongoing legal battle may set a precedent for how companies approach and communicate data breaches, highlighting a broader trend in securities litigation focusing on cybersecurity risks as material factors that impact investors.