 |
Photo courtesy of Coupang |
[Alpha Biz= Lee Joonhyun] Coupang has come under scrutiny after it was revealed that the company belatedly reported a large-scale customer data breach to the U.S. Securities and Exchange Commission (SEC).
According to industry sources on December 17, Coupang Inc., the parent company of Coupang, disclosed in a Form 8-K filed with the SEC on December 15 (local time) that it had become aware of an incident involving unauthorized access to customer data by a former employee.
In the filing, Coupang stated that it identified unauthorized access to customer accounts on November 18. The company explained that a single former employee may have obtained personal information associated with up to 33 million customer accounts, including names, phone numbers, shipping addresses, and email addresses. In addition, order histories for certain accounts may also have been compromised.
The controversy centers on the timing of the disclosure. Under SEC rules, publicly listed companies are required to disclose the nature, scope, and potential impact of a cybersecurity incident within four business days of determining that the incident is material. However, Coupang submitted the report approximately 12 business days after it said it became aware of the breach.
U.S. financial regulators impose strict penalties for delayed disclosures or the concealment of material information in order to protect investors. In a notable precedent, Yahoo was fined $35 million by the SEC in 2018 for failing to timely disclose a massive hacking incident that occurred in 2014, only revealing it two years later.
In its filing, Coupang said that Korean regulatory authorities have launched an investigation and that the company is fully cooperating. While acknowledging the possibility of administrative fines or penalties, Coupang stated that it is currently unable to reasonably estimate the potential financial impact or losses resulting from the incident.
Alphabiz 이준현 기자(wtcloud83@alphabiz.co.kr)
