CPNG 8-K/A: Coupang confirms 33M accounts accessed in cyber breach; to issue $1.2B in customer vouchers

Coupang confirms 33M accounts accessed in cyber breach; to issue $1.2B in customer vouchers

Coupang, Inc.

Perpetrator accessed 33M accounts using stolen security key; only retained data from ~3,000 accounts (name, email, address, phone, 2,609 building codes). No payment or login data.

All user data deleted and never shared with third parties; perpetrator identified, cooperating, devices recovered from river.

Coupang to issue ~1.685 trillion won ($1.2B) in purchase vouchers starting Jan 15, 2026, to all 33.7M notified customers.

Vouchers total 50,000 won per customer; reduce revenue recognized per transaction; forensic firms Mandiant, Palo Alto Networks, EY involved.

Government coordinated investigation; Coupang cooperated fully and submitted all devices to authorities.

Key facts

Extracted from this filing and checked against the source text.

Cybersecurity Incidents SEC 8-K Item 1.05 confidence 0.9

Coupang, Inc. disclosed a cybersecurity incident: Cybersecurity incident involving unauthorized access to approximately 33 million accounts, with limited data saved from approximately 3,000 customer accounts; perpetrator identified, cooperating, and data deleted without third-party sharing. Impact: Coupang Corp. announced a customer compensation program of approximately 1.685 trillion won ($1.2 billion) in vouchers, to be reflected as reductions to selling price and revenue. Materiality is still being assessed. Discovered 2025-12-24.

Nature: Cybersecurity incident involving unauthorized access to approximately 33 million accounts, with limited data saved from approximately 3,000 customer accounts; perpetrator identified, cooperating, and data deleted without third-party sharing.
Impact: Coupang Corp. announced a customer compensation program of approximately 1.685 trillion won ($1.2 billion) in vouchers, to be reflected as reductions to selling price and revenue.
Materiality: assessing
Discovery: 2025-12-24

Exact text from the filing

On December 24, 2025 (PST) and December 28, 2025 (PST), Coupang Corp., a wholly-owned Korean subsidiary (“Coupang Corp.”) of Coupang, Inc. (“Coupang, Inc.,” “our,” or “we”) (Coupang Corp., together with Coupang, Inc. and its subsidiaries and affiliates, “Coupang,”), issued updates (collectively, the “Updates”) on the cybersecurity incident (the “Incident”) disclosed in the Current Report on Form 8-K filed by Coupang, Inc. with the U.S. Securities and Exchange Commission (the “SEC”) on December 16, 2025.

View on SEC.gov