Coupang may face US SEC fine over user data breach

Coupang may face penalties from the US Securities and Exchange Commission (SEC) after failing to promptly disclose a major data breach affecting 33.7 million customers, according to industry observers.

Coupang Inc., headquartered in Seattle and listed on Nasdaq, is Korea’s largest ecommerce retailer and generates most of its revenue from Korea.

The leak, reportedly caused by a former employee between June and November, was first detected on November 18, 2025 when Coupang notified local authorities but did not inform US investors until later.

SEC rules require companies to disclose material cybersecurity incidents within four business days of determining their significance.

The affected customer count was initially reported as 4,500 but was later revised to 33.7 million.

🔗 Source: The Korea Times

🧠 Food for thought

Implications, context, and why it matters.

SEC cyber incident disclosure rules differ for foreign private issuers and domestic issuers

The article treats Coupang as bound by the four business day rule on Form 8-K Item 1.05. That timeline applies only if the SEC views Coupang as a domestic issuer. Domestic companies use Item 1.05 on Form 8-K for material cyber incidents, while FPIs furnish Form 6-K under different triggers 1.
Form 6-K has no Item 1.05 twin. FPIs report a material incident on Form 6-K when it is public in their home market, to an exchange, or to investors, and the form has no fixed section for that disclosure 1.
Penalty risk turns on Coupang’s filer status and the timing of the proper filing, not a four day clock unless it is domestic 1.
The article mentions Coupang informed Korean authorities on November 18. The SEC issue hinges on the right form and timeline for its status, rather than only Item 1.05.

US-listed Korean companies may tighten cyber disclosure workflows

Tech teams at other US-listed Korean firms should revisit Form 6-K workflows 2. Examples include KB Financial Group, Shinhan Financial Group plus SK Telecom and POSCO Holdings.
Vendors that sell SEC-ready disclosure software and advisory help can target these firms, as the Coupang episode exposes gaps for FPIs under US rules.
Build a prospect list of about 10 Korean stocks listed on US exchanges 2 to launch outreach that addresses FPI disclosure hurdles.