Shares of Coupang, Inc. (CPNG) advanced on Tuesday, driven by anticipation of a regulatory decision in South Korea that could determine the financial consequences of a major customer data breach. The stock rose 4.68% to $15.90 in New York trading, closing above Monday's $15.19 level.
The focus is on South Korea's Personal Information Protection Commission, which is deliberating penalties following a breach that exposed over 33 million pieces of personal information. The commission has been reviewing the case for about seven months since Coupang first disclosed the incident. Regulators sent a prior notice to the company in April and have since evaluated Coupang's response, which largely contested the findings, according to local media reports.
Under South Korean data-leak penalty laws, fines can reach up to 3% of revenue from violations. If applied to Coupang's 2025 revenue of 45.5 trillion won, the maximum penalty would be around 1.36 trillion won. However, the final amount will depend on factors such as the scope of revenue considered, the nature of the violation, and any adjustments for severity. The commission's largest previous fine was 134.8 billion won, imposed on SK Telecom for a SIM-data leak.
The potential fine is significant for Coupang's financial health. A penalty at the high end could erode near-term profits, while a more moderate fine might not trigger a severe market reaction, even if it sets a record. The company has already incurred costs from the breach, including about $1.2 billion in customer vouchers issued after the incident, with most redemptions occurring in the first quarter and ending by mid-April. Additional costs from remediation, inquiries, enforcement, and lawsuits remain possible.
Coupang's first-quarter results highlight the pressure. Revenue rose 8% year-over-year to $8.5 billion, but the company reported a net loss of $266 million. Adjusted EBITDA, a key operating metric, plummeted to $29 million from $382 million a year earlier. The company attributed some of the decline to the breach-related expenses.
Despite the regulatory overhang, Coupang has been active in share repurchases, buying back about 20.4 million Class A shares in the first quarter at an average price of $19.14. The board has also authorized an additional $1 billion for further buybacks, signaling confidence in the business. However, such measures do not offset the cash cost of a potential regulatory penalty.
Coupang has sought to limit reputational damage by clarifying the scope of the breach. The company stated that only names, email addresses, phone numbers, addresses, some order history, and a limited number of apartment entrance codes were compromised, with no payment information, financial data, user IDs, passwords, or ID documents affected. It also challenged the government's count on entrance code leaks, claiming only 2,609 accounts were impacted.
Separately, South Korea's fair-trade regulator fined Coupang's Korean unit 500 million won this week for misleading paid-membership customers about discounts. While the fine is the maximum for this infraction, it is relatively small for the company.
The privacy ruling, expected as early as Thursday morning in Seoul, will be a key catalyst for the stock. Investors will weigh whether Tuesday's bounce is a temporary relief or a sign that the market is pricing in a manageable outcome. A severe penalty could open the door for lawsuits and further regulatory scrutiny, potentially slowing customer growth and pressuring margins in Coupang's core Korea commerce business.
