Coupang Inc. (CPNG) had a much better Friday than it's had in recent weeks. The South Korean e-commerce giant's stock jumped nearly 6% after the company clarified something important: its investigation into a massive data breach wasn't some rogue solo operation. The company worked hand-in-hand with government authorities the entire time, according to Yonhap News Agency.
That matters because market speculation had been swirling that Coupang handled the probe on its own, without official oversight or anyone checking its work. Turns out that wasn't the case, and investors liked hearing it.
How the Investigation Actually Went Down
Here's what Coupang says happened: On December 9, government authorities told the company to contact a former employee. Following those instructions, Coupang handed over the person's desktop hard drive and laptop to police on December 21. Two days later, on December 23, the company submitted a detailed report documenting its meetings with the suspect and all the evidence it had collected.
The day before going public with these details, Coupang revealed that its forensic analysis had identified the former employee as the source of the breach. The individual confessed and explained exactly how they got into the system.
According to the company, the suspect managed to steal security keys and used them to access basic customer information connected to nearly 34 million accounts. That's a staggering number, but there's a slightly less terrifying detail: data from only about 3,000 accounts was actually saved before being deleted.
A Breach With Real Consequences
This wasn't Coupang's first rough day over this incident. Back on December 1, the stock dropped 5% when the company first disclosed the data breach affecting 33.7 million users. The leaked information included names, email addresses, delivery locations, account details, and some order data. Local media labeled it South Korea's largest data leak, which is the kind of superlative no company wants attached to its name.
South Korea's Personal Information Protection Commission launched its own investigation, and the potential consequences are severe. The company faces possible fines reaching roughly $770 million.
About three weeks after the breach became public knowledge, CEO Park Dae-jun resigned, CNBC reported. The company moved quickly to fill the gap, appointing Harold Rogers, its chief administrative officer and general counsel, as interim CEO.
A Wake-Up Call for Korean Firms
Industry analysts see this incident as more than just one company's problem. Peter Kim of KB Securities told CNBC that cybersecurity vulnerabilities might be a broader issue across South Korean companies. His theory? Cost-cutting pressures may have pushed firms to underinvest in cybersecurity infrastructure, leaving them exposed to exactly this type of attack.
It's a cautionary tale about what happens when protecting customer data takes a back seat to trimming expenses. And judging by Friday's stock movement, investors care a lot about how companies handle the aftermath when things go wrong.
CPNG Price Action: Coupang shares were up 6.23% at $24.22 during premarket trading on Friday.
