Investors file US class-action lawsuit over Coupang data breach

A new class-action lawsuit against Coupang Inc. has been filed in a US federal court, following the massive data breach of over 33 million users at Korea’s leading online retailer.

New York-based investor rights law firm The Rosen Law Firm, and Joseph Barry, an investor of New York Stock Exchange-listed Coupang Inc., on Thursday filed the class-action lawsuit in the US District Court for the Northern District of California on behalf of buyers of the company's securities between Aug. 6 and Dec. 16 this year.

This is in addition to a class action suit planned on behalf of users by a separate law firm that was announced earlier this month.

According to the lawsuit, the complaint was filed against Coupang Inc., Coupang Chief Financial Officer Gaurav Anand and Coupang founder Bom Kim. Kim holds a majority of voting rights in Coupang Inc., which holds a 100 percent stake in Korean Coupang, where the data breach occurred.

The complaint argued that the defendants made false and misleading statements and failed to disclose that Coupang had inadequate cybersecurity protocols that allowed a former employee to access sensitive customer information for nearly six months without being detected. It says this subjected the company to a materially heightened risk of regulatory and legal scrutiny.

It added that when the defendants became aware of the data breach, they did not file a report to the US Securities and Exchange Commission in compliance with applicable reporting rules.

Despite discovering the data breach that leaked information of customer names, phone numbers and email and delivery addresses on Nov. 18, the complaint pointed out that Coupang did not receive a filing exemption from the US Attorney General to exempt it from report the incident on Form 8-K, a regulatory filing public companies must submit to the SEC to notify major events that shareholders should know about within four business days of an event.

Coupang eventually filed an 8-K report to the SEC on Dec. 16, saying that the company activated its incident-response procedures, blocked the threat actor’s unauthorized access, reported the incident to relevant regulatory and law enforcement authorities in Korea and notified the customers whose data may have been accessed.

According to the US District Court for the Northern District of California, the case management statement is due by March 13 next year with its initial case management conference set for March 20. The court has issued a summons to Coupang Inc., Coupang Chief Financial Officer Gaurav Anand and Coupang founder Bom Kim.