More U.S. investors sue South Korean government over handling of Coupang data breach

The fallout from Coupang's extensive data breach in South Korea has escalated into a significant geopolitical issue, with a growing number of U.S. investors suing the South Korean government. What started as a regulatory inquiry into the company's data security practices has evolved into a larger conflict over perceived discriminatory treatment of the U.S.-based e-commerce giant. Coupang, often likened to Amazon for its operations in South Korea, Taiwan, and Japan, is headquartered in Seattle, Washington. Investors are now pursuing international arbitration under the U.S.-Korea Free Trade Agreement (FTA), following a notice filed on January 23, 2026, by U.S. investment firms Greenoaks and Altimeter. They claim to have incurred losses due to what they describe as the government's biased investigation into the data breach. Recently, three additional investors, including Abrams Capital, Durable Capital Partners, and Foxhaven Asset Management, have joined the legal action, alleging unlawful conduct by the South Korean government towards Coupang. In December, the company revealed that approximately 34 million personal records of Korean customers had been compromised in a breach that lasted over five months, exposing sensitive information such as names, email addresses, and shipping details. Unlike other tech violations in South Korea that have resulted in lighter penalties, Coupang has faced severe government scrutiny. Reports indicate that the government threatened hefty fines, operational suspensions, and travel bans for executives while allegedly trying to suppress public discourse and distort facts surrounding the breach. The Korea Personal Information Protection Commission (PIPC) noted that over 30 million accounts were compromised, though Coupang's investors assert that only around 3,000 accounts were truly affected. The South Korean government has indicated that the breach warrants increased fines, which could reach up to $800 million under current laws. However, some lawmakers are advocating for a retroactive cap increase to 10%. Even if such legislation passes, it would not apply to Coupang, given that the breach occurred prior to any changes in regulations. Public calls for stringent penalties have been echoed by South Korean President Lee Jae Myung, who believes that Coupang has not faced adequate repercussions for the breach. The investors’ legal filing describes the government's actions as an "unprecedented assault" on a U.S. firm to favor local competitors, claiming it violates international treaties and undermines the historic U.S.-Korea partnership. As the situation unfolds, South Korea’s Ministry of Justice is currently reviewing the notice of intent filed by the investors, which begins a mandatory 90-day consultation period before arbitration can commence. While Coupang and its investors have not commented on the situation, the Ministry of Science and ICT stated that the breach was reportedly perpetrated by a former employee aware of the company's vulnerabilities. The ministry alleges that Coupang failed to report the breach within the required timeframe and did not adhere to a data preservation order, leading to the deletion of critical access logs. In response, Coupang has acknowledged that while data from over 33 million accounts were accessed, only about 3,000 records were retained before deletion. This data breach has now sparked broader discussions about the treatment of U.S. technology firms in South Korea, with growing concerns that local policies may unfairly disadvantage American companies. As the legal battle continues, it raises significant questions about trade dynamics and the future landscape of digital business operations between the two nations.