Where is Coupang headed?

The recent News report details a controversial “self-investigation” by Coupang regarding a massive personal data leak and the South Korean government’s subsequent fury over the company’s behavior.

The Story: Coupang’s “Self-Investigation”

Coupang abruptly announced the results of its own internal investigation into a data breach that potentially compromised the information of 33 million users.

• The Leaker: Coupang identified the culprit as a former employee, a Chinese national, whom they tracked down and interviewed abroad.
• The Breach: According to Coupang, the individual used an internal security key to access 33 million accounts but only stored data for approximately 3,000 accounts, including 2,000 apartment entrance codes.
• Evidence Recovery: The leaker allegedly smashed their laptop, placed it in a bag weighted with bricks, and threw it into a river. Coupang claimed to have hired divers to recover the device and insisted that the data was never transmitted to third parties.
• Lack of Cooperation: Notably, Coupang conducted this investigation and met with the suspect without any prior consultation or cooperation with the South Korean government or police.

Government’s View and Reasons for Fury

The South Korean government and law enforcement are “furious” and highly skeptical of Coupang’s unilateral actions.

• Contaminated Evidence: The police questioned how the very target of a criminal investigation could be allowed to conduct its own probe, noting that statements and evidence (like the laptop) could have been contaminated or manipulated.
• “Media Play”: The Ministry of Science and ICT (MSIT) viewed the announcement as an attempt to sway public opinion and minimize liability before official findings were released.
• Weak Sanctions: President Lee Jae Myung expressed strong frustration, stating that current economic sanctions in Korea are too weak, leading companies to treat law-breaking lightly.

Planned Government Actions

Following the report, the Presidential Office held an emergency meeting with cabinet-level officials to discuss severe countermeasures:

• Management Sanctions: The government is discussing ways to punish Coupang’s management and implement stronger administrative sanctions.
• Expanded Task Force: The inter-ministerial Task Force (TF) will be elevated from a Vice-Minister level to a Prime Minister-led group to handle the situation more aggressively.
• Consumer Relief: New measures for consumer protection and compensation are being prioritized to ensure the company feels the weight of its responsibility.
• Lobbying Investigation: Authorities are also looking into allegations that Coupang lobbied U.S. political and government figures to use its status as a “U.S. company” as a shield against Korean regulations.

What if this happened to a U.S. Company in the U.S.?

If a U.S.-listed company acted similarly with American user data, the consequences would likely be far more severe than what Coupang has faced so far:

• Massive Punitive Damages: In the U.S., courts can impose “punitive damages” far beyond actual losses. For example, Facebook was fined $5 billion and Equifax settled for $700 million for similar privacy failures.
• Strict Disclosure Laws: U.S. regulations (SEC) require listed companies to disclose material cybersecurity incidents within four business days. Failure to do so can lead to criminal charges and federal investigations.
• The Discovery Process: U.S. courts have the power to compel companies to turn over all relevant data and internal communications, making it much harder for a company to hide the full extent of a breach through a “self-investigation”.
• Presidential Stance: President Lee Jae Myung noted that in a stricter regulatory environment, such behavior should make a company feel like it might “go bankrupt”.

Our Take: Accountability is the Only Way Out

Coupang may have won the hearts of the Korean people through the convenience of “Rocket Delivery,” but they are ignoring the most vital rule of business in the social media age: reputation can be destroyed in a few viral posts.

Viral sentiment is a double-edged sword. Given Coupang’s utter disregard for the Korean public—the very people who generate over 90% of the company’s profit—there is no upward trajectory in sight for their brand image.

It is time for the CEO and executives to:

1. The law may shield you, but it does not excuse you.
2. Cooperate fully with the government’s investigation without “media play.”
3. Offer a sincere, public apology and a transparent plan to compensate for the damage done.
4. True leaders accept responsibility. Those who hide behind process merely prove they are unworthy of it.

The storm will not calm until Coupang stops looking for excuses and starts looking for solutions. It’s time to be an adult and do the right thing.