Securities Regulation Daily Wrap Up, FRAUD AND MANIPULATION—N.D. Cal.: Cybersecurity breach leads to class action, (Jan 2, 2026)

By R. Jason Howard, J.D.

The breach has been recognized as the most damaging data breach in South Korean history.

A class action complaint filed in the Northern District of California alleges that Coupang, Inc., its CEO and CFO made materially false and misleading statements concerning the company’s risk of a material cybersecurity event (Barry v. Coupang, Inc., No. 3:25-cv-10795-VC (N.D. Cal. Dec. 18, 2025)).

Coupang. The company describes itself as “one of the fastest-growing technology and commerce companies in the world, providing retail, restaurant delivery, video streaming, and fintech services to customers around the world under brands that include Coupang, Coupang Eats, Coupang Play and Farfetch.”

The complaint asserts that the company’s 2024 annual report included a risk disclosure that was materially false and misleading because at the time the statement was made, a “former Coupang employee (who had, inexplicably, retained access to Coupang’s internal systems) had, for over a month, conducted an undetected breach of Coupang’s internal systems with the intent to expose sensitive information about tens of millions of Coupang customers.”

On November 18, 2025, Coupang discovered that the breach had occurred which led to the exposure of personal information of over 33 million of its customers, including customer names, email addresses, and delivery addresses. The breach has been recognized as the most damaging data breach in South Korean history, but Coupang did not disclose the information in a Form 8-K by November 24, 2025, four business days after November 18, 2025, and it did not disclose the breach after the media learned of and covered the event.

The complaint alleges that the defendants made false and/or misleading statements and/or failed to disclose that: the company had inadequate cybersecurity protocols that allowed a former employee to access sensitive customer information for nearly six months without being detected; (2) this subjected Coupang to a materially heightened risk of regulatory and legal scrutiny; (3) when defendants became aware that Coupang had been subjected to this data breach, they did not report it in a current report filing with the SEC in compliance with applicable reporting rules; and (4) as a result, defendants’ public statements were materially false and/or misleading at all relevant times.

When the truth emerged, there was a precipitous decline in the market value of the company’s common shares and, as a result, the plaintiff and other class members suffered significant losses and damages, according to the complaint.

Relief sought. The complaint was filed on behalf of all persons and entities who purchased or otherwise acquired Coupang securities between August 6, 2025, and December 16, 2025, and seeks a determination that the action may be maintained as a class action with damages including pre-and post-judgment interest as well as fees and expenses and any other relief the court deems just and proper.

The case is No. 3:25-cv-10795-VC.

Attorneys: Laurence Matthew Rosen (The Rosen Law Firm, P.A.) for Joseph Barry.

Companies: Coupang, Inc.

LitigationEnforcement: CorporateGovernance CyberPrivacyFeed DataBreach DirectorsOfficers FormsFilings FraudManipulation GCNNews InvestorEducation SarbanesOxleyAct SECNewsSpeeches ShareholderActivismNews CaliforniaNews DelawareNews