Coupang faces US class action and possible Korea suspension after data breach affecting 33.7 million users

Coupang Inc., a U.S.-listed e-commerce company operating South Korea’s largest online retail platform, is facing mounting legal and regulatory pressure following a data breach that exposed personal information tied to about 33.7 million customers, roughly two-thirds of South Korea’s population. The incident has triggered a class action lawsuit in the United States and prompted South Korean authorities to signal that a suspension of the company’s domestic operations remains under consideration.

South Korea’s Fair Trade Commission, the country’s competition and consumer protection regulator, said Friday that business suspension is a possible sanction depending on the outcome of an ongoing investigation. During a televised interview, Fair Trade Commission Chairperson Ju Biung-ghi said authorities will first determine whether consumers suffered or face a risk of financial harm and whether Coupang failed to take adequate remedial measures. If those conditions are met, a suspension of operations could be imposed.

The remarks followed the launch of a joint government task force on Thursday involving the Fair Trade Commission, the Ministry of Science and ICT, the National Intelligence Service, and the police. The task force is examining the cause of the breach, the scope of user protection failures, and potential regulatory actions, including business suspension. Deputy Prime Minister and Science and ICT Minister Bae Kyung-hoon said the breach posed a fundamental threat to the daily lives of the public.

Government scrutiny has intensified amid criticism of Coupang’s response to the incident. At a National Assembly hearing on Wednesday, interim Chief Executive Officer Harold Rogers said the leaked data was not considered highly sensitive and therefore did not require disclosure to the U.S. Securities and Exchange Commission. Coupang Chairman Kim Bom-suk, also known as Bom Kim, has not publicly addressed the breach despite repeated calls from lawmakers to testify.

Under South Korea’s Act on the Consumer Protection in Electronic Commerce, the Fair Trade Commission may temporarily suspend a company’s operations if a personal data leak is confirmed, consumers have suffered or are at risk of financial losses, and the operator failed to take necessary corrective steps. Industry observers note that suspensions have historically been rare and typically applied to smaller platforms where intentional consumer harm was established. The law also directs regulators to favor fines when a suspension could cause broader harm to consumers or the market, a factor seen as significant given the large number of merchants reliant on Coupang’s platform.