FEDERALItem 1.05 · mandatoryHackingRetail & ConsumerTechnologyRetailGeneral MerchandiseCustomer Data InvolvedCriticalActive

Coupang, Inc.

bd_8589743521e54e20 · schema v1 · pii pii-v1

Severity

Critical

Financial impact

$1.20B

Discovered

—

Filed

Dec 29, 2025

To disclose

—

Affected

33,000,000

Linked

3 filings

Confidence

83%

Full breach record for Coupang, Inc. →

Coupang, Inc. filed Form 8-K/A (Amendment No. 1) updating disclosure of a cybersecurity incident at its wholly-owned Korean subsidiary, Coupang Corp. Approximately 33 million accounts were accessed; the perpetrator saved limited data from approximately 3,000 customer accounts, which has been deleted and not shared with a third party. The perpetrator has been identified and is cooperating. Coupang announced a ~1.685 trillion KRW (~$1.2 billion) customer voucher compensation program starting January 15, 2026.

J jump to incidentP pin to compareR raw source

SEC clockMateriality determined Dec 16, 2025 → Filed Dec 29, 202513d ✗ SEC 4-day late

⚠ no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.

Incident timeline — partial

? — ?

Breach window unknown

Dec 29, 2025

Filed

—

Corroborated · see linked filings

Compliance clocks stay unassessable until a regulatory filing lands. Dashed segments fill in automatically when corroboration arrives.

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

SEC 8-Kbd_64f7ce544edaa9842025-12-16 · +13dVerified by operator
SEC 10-K Item 1Cbd_a02211a345ae17932026-02-26 · +59dVerified by operator

Name: Coupang, Inc.
norm: coupang
SEC CIK: 0001834584
Domain: coupang.com

Name: Coupang, Inc.
norm: coupang
Domain: coupang.com
Industry: Retail & ConsumerllmTechnologyllm
NAICS 455219 · All Other General Merchandise Retailers

Discovered: —
Materiality determined: Dec 16, 2025
Notification sent: Nov 30, 2025
Affected individuals: 33,000,000nationwide
Data types: —
Attack vector: Unknown
Threat actor: External
Regulator citations: Filed Form 8-K/A with the U.S. Securities and Exchange Commission

During the incident: Issued updates on the cybersecurity incident
Identified the perpetrator of the Incident, who is cooperating with Coupang and investigators
Perpetrator turned over all devices used in the Incident
Customer data saved by the perpetrator has been deleted without having been shared with a third party
Notified affected customers at the end of November 2025
Changes made: Announced a customer compensation program to issue approximately 1.685 trillion won (approximately $1.2 billion) worth of vouchers starting January 15, 2026
Source: Quoted from the filing itself, not independently verified.

Compliance flags: SEC 4-day late · 13d
Discovery-date grounding: no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.
Clock breakdown: Statute Window Elapsed Threshold Status
SEC
Materiality determined: Dec 16, 2025
→ Filed: Dec 29, 2025
13d cal. 4 business days SEC 4-day late

Statute	Window	Elapsed	Threshold	Status
SEC	Materiality determined: Dec 16, 2025 → Filed: Dec 29, 2025	13d cal.	4 business days	SEC 4-day late

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings

View merged incident ↗

SEC 8-KDec 16 · first

SEC 8-K+13d · this page

SEC 10-K Item 1C+72d

Pattern: first filing Dec 16, last Feb 26 — a 72-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filing

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statementThis record

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.sec.gov/Archives/edgar/data/1834584/000183458425000202/cpng-20251215.htm
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Dec 29, 2025
Raw hash: 7c3183a5fbbbe36b81e6338f78a20157a7025796ce2c2f01127d067fa399e694

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html33.0 KB

Download View at source

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityCoupang, Inc.

Victim entityCoupang, Inc.

IncidentUnknown

Stated responseIssued updates on the cybersecurity incident

ComplianceSEC 4-day late

Extraction provenanceno artifact recorded

Source provenancewww.sec.gov

Source filing