Home > Business > Industry

Nearly half a million Coupang users join class action over data leak

Published: 25 Dec. 2025, 19:58

A Coupang warehouse in Guro District, western Seoul is seen on Dec. 23. [NOH YU-RIM]

Nearly 500,000 Coupang users are joining class-action lawsuits over a massive data breach, with nine of the 11 law firms handling the case reporting a total of 483,800 participants, according to an investigation by the JoongAng Ilbo.

Each plaintiff is seeking between 100,000 won ($62) and 1 million won in damages. The average amount claimed per person is 132,699 won, with the total value of the suits amounting to 64.2 billion won.

“Many plaintiffs say they’re more upset by Coupang’s response to the incident than the actual data leak,” said attorney Kim Byung-kuk of Law Firm Bun Hwa. “They want clear accountability.”

If the court rules in favor of even one of the 11 lawsuits, Coupang’s compensation liabilities could skyrocket, potentially encouraging more victims to file suit. If Coupang were to compensate all affected users with the average amount claimed — 130,000 won per person — the total payout could exceed 4.47 trillion won, more than 3.5 times the company’s total operating profit of 1.28 trillion won last year.

“The outcome of the first trial will likely influence the other cases,” said attorney Jeong Tae-won of the law firm LKB Pyeongsan. “Class actions may continue until the statute of limitations expires.”

In previous major data breach cases in Korea, compensation has typically hovered around 100,000 won per person. However, President Lee Jae Myung has raised the possibility of punitive damages, which may increase the eventual payouts.

A Coupang deliveryperson is seen moving packages at a warehouse in Seoul on Dec. 16.. [NEWS1]

Under the Personal Information Protection Act, punitive damages of up to five times the actual loss can be awarded if personal data is leaked or stolen due to willful misconduct or gross negligence by the data handler.

“We will argue for compensation that includes emotional distress as well as punitive damages,” Jeong said. “Most previous cases involved hacking, but in Coupang’s case, the leak was caused by an employee, exposing weaknesses in the company’s security system.”

Many plaintiffs have reported psychological distress following the breach. Coupang acknowledged that names, phone numbers, email addresses and delivery addresses were leaked.

Although the company said no resident registration or credit card numbers were exposed, users remain fearful. Apartment residents, in particular, have voiced concern that shared entryway passwords may have been leaked.

A Coupang delivery truck is seen parked at a lot in Seoul on Dec. 25. [YONHAP]

Law firms handling the case have documented numerous incidents from plaintiffs: “I saw a stranger pressing buttons on my door lock and called the police,” one said.

“I live alone and now can’t sleep without medication because anyone could come to my home,” another person said.

One person expressed guilt, saying, “I often sent packages through Coupang to my elderly parents — now I’m worried their address was also exposed.”

Other reported cases include: “I’ve received ten times more phishing and spam calls over the past three weeks,” “A scam caller knew my name and address,” and “I had to reset all my online passwords because they were similar to the one I used for Coupang.”

“One user said they found a foreign login on their Coupang app, even though they’ve never traveled abroad,” said attorney Ha Hee-bong of Lawpid Law Office.

Kim Kuk-il, managing partner of Daeryun law firm, speaks during a press conference announcing a class-action lawsuit against Coupang Inc., the American parent company of e-commerce giant Coupang, at the law firm's New York office in Manhattan on Dec. 8. [NEWS1]

The number of plaintiffs is growing rapidly. Over the three-day period of interviews conducted by the JoongAng Ilbo, the number of class action participants increased by about 30,000 per day.

Users can file claims through the websites of participating law firms. Proof of damages, such as the breach notification message sent by Coupang, is typically sufficient to apply.

“Punitive damages can be difficult to justify if actual damages are hard to prove, but if shared entry passwords had to be changed, the incidental cost — including time — could become a critical factor in determining compensation,” said Choi Kyoung-jin, a professor of law at Gachon University.

This article was originally written in Korean and translated by a bilingual reporter with the help of generative AI tools. It was then edited by a native English-speaking editor. All AI-assisted translations are reviewed and refined by our newsroom.
BY CHOI HYUN-JU, LIM SUN-YOUNG, NOH YU-RIM [[email protected]]