Coupang Inc. shares advanced in early New York trading Thursday, rising 5.6% to $15.96, after South Korea's privacy regulator levied a record $410 million penalty against the e-commerce giant. The fine, related to a 2025 data breach and unauthorized data collection, finally gives investors a concrete figure for a regulatory overhang that has weighed on the stock for months.
The Personal Information Protection Commission (PIPC) announced penalties totaling 624.681 billion won (approximately $410 million), including administrative fines and corrective orders. The regulator said the breach affected 37.55 million individuals whose personal data was leaked, while an additional 11.17 million had their online activity tracked without consent. The fine represents about 1.4% of Coupang's 2025 revenue of 45 trillion won.
Coupang disclosed in an SEC filing that the penalty will be recorded as an operating expense in the second quarter, impacting the company's general and administrative costs rather than as a financing item. The company has not yet received the PIPC's written decision and plans to vigorously appeal the ruling at the Seoul Administrative Court. However, it noted that payment is not suspended during the appeal process and the fines are not tax-deductible.
The regulatory action stems from what the PIPC described as a basic failure in security controls, not a sophisticated cyberattack. “This accident occurred due to Coupang’s lack of safety measures and systems,” PIPC head Song Kyung-hee told reporters, according to Reuters. The company had already set aside approximately $1.2 billion in customer vouchers related to the incident, with redemptions beginning in January 2026, which will reduce future revenue.
Investors have viewed the clarity on the fine as a positive development, even though the amount is substantial. The stock had been under pressure since the breach was disclosed, with uncertainty over the potential cost. Now that the figure is known, the market can better assess the company's financial outlook. In the first quarter, Coupang reported net revenue of $8.5 billion, up 8% year-over-year, but posted a net loss of $266 million. Adjusted EBITDA was just $29 million, highlighting the margin pressure the company is facing.
The competitive landscape in South Korea is also intensifying. Rivals have attempted to poach customers following the breach, and a proposed regulatory shift could increase competition in ultra-fast overnight delivery, a key advantage for Coupang. The company's Product Commerce active customers edged up only 2% to 23.9 million in Q1, while adjusted EBITDA for that segment fell sharply to $358 million from $550 million a year earlier.
Looking ahead, Coupang faces several risks. The appeal process could be lengthy, and the company must comply with the PIPC's order to improve safeguards, notify affected non-members, expand the chief privacy officer's role, and report back within three months. Ongoing class-action lawsuits and potential additional regulatory costs could extend the financial impact into later quarters. While the market has responded positively to the clarity, any signs of prolonged customer trust issues or further regulatory setbacks could reverse the gains.
