FEDERALItem 1.05 · mandatoryMisuseRetail & ConsumerTechnologyRetailGeneral MerchandisePrivilege AbuseData MishandlingData ExfiltratedCustomer Data InvolvedPIIIdentity (basic)CriticalActive

Coupang, Inc.

bd_64f7ce544edaa984 · schema v1 · pii pii-v1

Severity

Critical

Discovered

Nov 18, 2025

Filed

Dec 16, 2025

To disclose

28 days

Affected

33,000,000

Linked

3 filings

Confidence

91%

Full breach record for Coupang, Inc. →

Coupang, Inc. disclosed under Item 1.05 that its wholly-owned Korean subsidiary Coupang Corp. discovered on November 18, 2025 a cybersecurity incident in which a former employee may have obtained name, phone number, delivery address, and email address associated with up to 33 million customer accounts, plus certain order histories for a subset. No banking, payment-card, or login credentials were compromised. Korean regulators have opened investigations.

J jump to incidentP pin to compareR raw source

SEC clockMateriality determined Dec 15, 2025 → Filed Dec 16, 20251d ✓ SEC 4-day OK28 days discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

discovery → filing · 28 days

Nov 18, 2025

Discovered

Dec 15, 2025

Scope determined

Dec 16, 2025

Filed

vs. sector median

6 wks faster

This filing is one of 3 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

SEC 8-Kbd_8589743521e54e202025-12-29 · +13dCandidate
SEC 10-K Item 1Cbd_a02211a345ae17932026-02-26 · +72dVerified by operator

Name: Coupang, Inc.
norm: coupang
SEC CIK: 0001834584
Domain: coupang.com

Name: Coupang, Inc.
norm: coupang
Domain: coupang.com
Industry: Retail & ConsumerllmTechnologyllm
NAICS 455219 · All Other General Merchandise Retailers

Discovered: Nov 18, 2025
Materiality determined: Dec 15, 2025
Notification sent: —
Affected individuals: 33,000,000
Data types: PIIIdentity (basic)
Attack vector: Insider
MITRE ATT&CK: T1078 Valid AccountsT1530 Data from Cloud Storage Object
Threat actor: Internal
Regulator citations: Reported the Incident to relevant Korean regulatory and law enforcement authoritiesKorean regulators have initiated investigations with which Coupang is fully cooperating
Initial access: insider_action

During the incident: Activated its incident response processes
Disabled the threat actor's unauthorized access
Reported the Incident to the relevant Korean regulatory and law enforcement authorities
Warned customers whose data was potentially accessed
Engaged external forensic experts to assist with the investigation
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 28 days(28 days from discovery to filing)
Compliance flags: SEC 4-day OK · 1d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Clock breakdown: Statute Window Elapsed Threshold Status
SEC
Materiality determined: Dec 15, 2025
→ Filed: Dec 16, 2025
1d cal. 4 business days SEC 4-day OK

Statute	Window	Elapsed	Threshold	Status
SEC	Materiality determined: Dec 15, 2025 → Filed: Dec 16, 2025	1d cal.	4 business days	SEC 4-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings

View merged incident ↗

SEC 8-KDec 16 · first · this page

SEC 8-K+13d

SEC 10-K Item 1C+72d

Pattern: first filing Dec 16, last Feb 26 — a 72-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filing

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statementThis record

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.sec.gov/Archives/edgar/data/1834584/000183458425000196/cpng-20251215.htm
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Dec 16, 2025
Raw hash: 8ff3e4e47cf8027c0301fdf2cd18268b10d37a7ab107ca0140b408db41f54daf

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html27.0 KB

Download View at source

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityCoupang, Inc.

Victim entityCoupang, Inc.

Incidentdiscovered Nov 18, 2025

Stated responseActivated its incident response processes

ComplianceSEC 4-day OK

Extraction provenanceno artifact recorded

Source provenancewww.sec.gov

Source filing