Press Coverage

[Anchor] His apology, which was released to the public only two days before the hearing, contains belated reflection and regret. However, there are many confusing parts as to whether it is a sincere apology to customers or a sophisticated tactic to avoid immediate political and legal risks. Reporter Soo-jin Song reads between the lines of the apology. [Report] "My apology was late" and "I cannot help but feel devastated." Chairman Kim Beom-seok devoted half of the apology to reflection and expression of regret. 2,000 characters. Nearly a thousand letters in the middle meant an apology. However, if you remove the apology, there is a sophisticated strategy. First of all, except for the expression 'wrong judgment', the word 'wrong' was not used. Instead, the large-scale information leak and a series of situations were defined as 'failure' and 'insufficient'. Customer damage was also listed with emotional words such as 'anxiety' and 'worry', but no actual damage was specified. The reason for the delay in the apology was that it could not be helped due to the government's request to maintain confidentiality. They are indirectly blaming the government. Since it is not an intentional cover-up, it appears to be a request for indulgence. Expressions such as 'full cooperation with the government and compliance with government requests' appear everywhere. It appears to be an attempt to break the government-versus-Coupang structure that emerged with the announcement of the results of the 'self-investigation'. In his apology, Chairman Kim Beom-seok claimed that 'misinformation' is rampant and spreading, but Coupang did not reveal what the misinformation was. [Kook-il Kim/Daeryun Law Firm Lawyer/Representative in U.S. litigation: "3,000 items were saved, 100% recovered. Then, the people filing the class action now are meaningless and only the people who fall under those 3,000 items should be compensated. Such a frame..."] The decisive factor is the timing of the apology announcement. Ahead of the hearing two days later, Chairman Kim included reflection, preparation of compensation plan, and promise to prevent recurrence in the apology. The company has built up a justification for doing everything it can. This is where the analysis of the high-level strategy to neutralize it comes in. This is Soo-jin Song from KBS News. Camera reporter: Won-seok Choi/Video editor: Hyun-mo Lee/Graphics: Mi-joo Park[View full article] Beomseok Kim’s precise timing… Is your intention ‘defense’? (Shortcut)

[Anchor] Coupang created a reversal in the New York stock market, with its stock price soaring. On the first trading day after the announcement of its own investigation results, the stock price rose by more than 6%, successfully rebounding. Coupang announced that only the information of '3,000 people', not 33.7 million people, was leaked, and that there would be no additional leaks. Controversy is growing over whether it was a player to appease the U.S. market and minimize the amount of compensation. First news Soo-yeon Lee [Report] Coupang Inc., Coupang's parent company. The stock price soared more than 6% on the New York Stock Exchange on the 26th, local time. After falling nearly 20% after the large-scale personal information leak became known, it rebounded on the first trading day after announcing the results of its own investigation. On the 25th, Christmas Day, Coupang made a sudden announcement that it had contacted the information leak suspect and recovered personal information and equipment. Around the same time, in the United States, a large law firm, Hagans Berman, joined the company. A class action lawsuit has been filed against Coupang Inc. There is analysis that Coupang may have rushed the announcement as a series of class action lawsuits in the U.S. alleging that shareholders suffered damages due to late disclosure of serious cyber security incidents. [Son Dong-hoo/Attorney at SJKP, U.S.: "In U.S. class action lawsuits, punitive damages are also included in the part about being a nuisance. The longer management's decision is delayed, the worse the court will view it."] The government. A unilateral announcement that said it followed 'instructions' but had no 'consultation' with the government. The claim that 33.7 million people's information was leaked, but the suspect saved only 3,000 people can also be interpreted as a strategy to minimize legal responsibility. Although the company is cooperating with the government's investigation, some analyze that it may have attempted a reversal as public opinion continued to deteriorate. Even on the day of the hearing on the 17th, Coupang had already contacted the suspect and retrieved hard disks, etc., but the government issued a silence order to avoid comment. [Harold Rogers/CEO of Coupang/17th: “The investigation is ongoing every day, and we are currently faithfully cooperating with the investigations of various regulatory agencies to understand the situation.”]Coupang plans to announce a compensation plan for former customers who suffered information leaks soon before the National Assembly hearing. It is interesting to see whether this will include an apology from CEO Kim Beom-seok. KBS News This is Soo-yeon Lee. Camera reporter: Min-sik Ahn/Video editor: Joo-hee Na/Graphics: Hyun-soo Yeo[View full article] Is Coupang’s ‘surprise announcement’ for the US?… Compensation plan will be revealed soon (link)

Why did you make the announcement arbitrarily after 'passing Korea'? Analysis to gain an advantage in the trial even if you risk domestic criticism. An analysis has been raised that the reason Coupang conducted its own investigation into the suspect of personal information leakage and arbitrarily announced the relevant information without consulting with the government was because it considered the trial in the United States to be the top priority. This means that it was done in a position where it had no choice but to lead the lawsuit filed in the United States to its advantage even if it had to endure domestic criticism. According to the legal and distribution industry on the 26th, the American law firm Hagens Berman announced the day before that it would enter a shareholder class action lawsuit on behalf of Coupang Inc investors. This is the second Coupang Inc shareholder class action lawsuit, following the shareholder class action filed by Rosen, an American law firm, on the 18th. The argument of the class action plaintiffs is clear. Coupang Inc. belatedly disclosed a serious cybersecurity incident, and shareholders suffered damage due to the resulting drop in stock price. The U.S. Securities and Exchange Commission (SEC) stipulates that if a company determines that it is a serious security incident, it must disclose it within 4 business days. Coupang made a related announcement on the 16th of this month, more than two weeks after announcing the large-scale leak on the 29th of last month. Experts believe that Coupang made the announcement unilaterally, risking conflict with the Korean government in order to claim that it was not a serious security incident. It should be argued that the scale of the information leak was small, but this means that Coupang was anxious that the work progress of the Korean police and the public-private joint investigation team would not meet Coupang's expectations. The results of its own investigation announced by Coupang are in line with expert analysis. Coupang claimed that the amount of information stolen outside the company was only about 3,000 people. This is an argument that can be used as evidence that the materiality does not meet the SEC disclosure requirements. The detailed disclosure of the forensic investigation process in cooperation with American companies Palo Alto Networks and Mandiant and the laptop recovery process using divers is also interpreted as a strategy to persuade the American jury, which is composed of ordinary citizens. Son Dong-hoo, attorney at Daeryun Law Firm, said, “Based on American precedents, the issues are whether the company’s investigation and follow-up actions were sufficient and the level of severity identified,” and “In this respect, the results of the internal investigation are important references in the trial.” He explained, “It will be data.” Reporter Taewoong Bae btu104@hankyung.com[View full article] Coupang seeks U.S. certification that ‘it was not a major security incident’ (Click here)

[Anchor] Coupang Chairman Kim Beom-seok officially apologized for the first time in a month. He said he would humbly accept criticism and reprimand, but said the apology was delayed due to the so-called 'self-investigation'. There is criticism that the controversy is justified again. First is Reporter Lim Ji-soo. [Reporter] Today marks the 40th day since Coupang reported a large-scale personal information leak. Coupang INC Chairman Kim Beom-seok apologized for the first time. Chairman Kim posted an apology on the Coupang website and admitted that the initial response was inadequate and communication was insufficient, saying, "I cannot help but be devastated by the situation in which the people were disappointed." After taking steps to prevent secondary damage, all facts were confirmed and an apology was made. Chairman Kim said, "We have been fully cooperating with the government from the beginning of the investigation," and "complied with the government's request to maintain confidentiality." As a result, he explained that he was negligent in explaining to the public. He then once again emphasized the results of his own controversial investigation. "After one month of effort, we have recovered 100% of the leaked customer information," he said. "We confirmed that it was limited to 3,000 cases and that it was not distributed or sold externally," and made the 'self-conclusion' through the internal investigation a fait accompli. The party being investigated for neglecting a serious infringement incident unilaterally repeatedly announced the results of the incomplete investigation. [Lee Eun-woo/Attorney (Coupang criminal complaint case legal representative): Not only did Coupang fail to manage retiree account rights, but it showed no signs of abnormalities for five months (after the incident occurred). [Failure to detect.] There is criticism that the announcement of results that emphasizes individual employee deviations while disclosing limited information is causing further consumer confusion. [Son Dong-hoo/Attorney (Representative of Coupang class action lawsuit in New York, USA): It is said that (Coupang) took action before attending the hearing, but it does not seem advantageous because the results of its own investigation will be treated very seriously in the (U.S.) court.] In his apology, Chairman Kim said he would prepare a compensation plan and implement it as soon as possible. Added. [Video editing by Park Soo-min and video design by Kim Yun-na] Reporter Lim Ji-soo (yim.jisoo@jtbc.co.kr)[View full article] Kim Beom-seok, ‘first apology’ in a month… Another controversy over ‘justification of self-investigation’ (link)

<Anchor>Coupang has started recruiting people from the U.S. government and Congress to work in Washington, where the U.S. diplomatic office is located. There is criticism that they are focusing only on lobbying while remaining silent on the response and compensation plan for large-scale personal information leaks that occurred in Korea. This is Reporter Baekwoon. <Reporter> This is a recruitment notice posted by Coupang Inc, the parent company of Coupang, on its website yesterday (23rd). The place of work is Washington, DC, USA. The qualification is more than 10 years of experience in the public sector such as the government and Congress, and the task is to develop and implement strategies to increase Coupang's reputation and awareness among policymakers and the media. Recently. It is believed that Coupang's newly opened Washington DC government relations office is hiring additional government relations staff. Coupang has spent more than 15 billion won in lobbying funds since its listing in the U.S. in 2021, and the number of hired lobbyists has increased from 4 to 32. The industry believes that the expansion of government relations staff is an attempt to attract more support from US political relations by emphasizing that Coupang is an American company. In addition, class action lawsuits in progress in the United States, etc. It seems that there is also a purpose to respond. In particular, in the United States, there is a 'discovery system' that requires the mandatory submission of even sensitive information from within the management, which is bound to put considerable pressure on Coupang. [Dong-hoo Son/Attorney, New York, USA: If discovery is initiated and the court gives permission, the target company is likely to have to disclose its internal security policy, incident recognition time, response process, and decision-making structure under the court's order.] Meanwhile, Coupang has filed a complaint regarding labor inspection by the local labor office in 2020. Regarding yesterday's SBS report that there were suspicions of all-round response, including eating with supervisors, the Ministry of Employment and Labor announced that it has begun a formal audit and is determining the facts. (Video coverage: Hyeong Yun, Video editing: Jinwon Kim, Design: Heungsoo Han, Taeyoung Park) Reporter Baekwoon cloud@sbs.co.kr[View full article] Coupang, was it scary in the U.S.? Looking at the ‘recruitment notice’ that was suddenly posted (Go here)

Coupang, which caused a large-scale personal information leak, is facing a series of class action lawsuits in the United States, where its headquarters are located. As judicial risks are gradually increasing, including the addition of the law firm that led the lawsuit related to the 'Dieselgate' emissions manipulation scandal by Volkswagen, Germany's largest automobile company in 2015, there are predictions that the US lawsuit could become the detonator of the Coupang incident. U.S. law firm Hagens Berman announced on the 24th (local time), “We have filed a class action lawsuit on behalf of Coupang investors against Coupang Inc., Coupang’s parent company.” Hagans Berman is a law firm that was the first in the United States to file a lawsuit related to Volkswagen's Dieselgate, which shocked the global automobile industry 10 years ago, and is credited with playing a leading role in obtaining compensation of $14.7 billion (about 17 trillion won in Korean currency at the time). The law firm said, "This lawsuit focuses on whether (Coupang) misled investors about the appropriateness of cybersecurity protocols." He also said, “An issue is also whether Coupang’s disclosure system was sufficient to notify investors in a timely manner within four days of a serious cybersecurity incident.” Coupang reported the relevant facts to the U.S. financial authorities on the 16th (local time), about a month after becoming aware of the leak incident (the 18th of last month). It is said that the rule that a serious cybersecurity incident must be announced within 4 business days was violated. This law firm plans to recruit additional Coupang Inc investors who have suffered damages by February 17th next year. The industry predicts that judicial risks originating from the United States may be the detonator of the Coupang incident. In particular, in the United States, there is a 'discovery system' in civil litigation that mutually discloses evidence held by the parties before the trial begins, so if the law firms' claims are accepted, Coupang Inc may have to disclose sensitive data such as internal meeting minutes and emails. Another reason to pay attention to the U.S. lawsuit is that if punitive damages are applied, the amount of compensation could be astronomically high. On the 18th (local time), attorney Lawrence Rosen and U.S. shareholders of Coupang Inc filed a class action lawsuit, saying, “Coupang’s inadequate security protocols allowed a former employee to gain unauthorized access to customer information for six months.” They cited ‘damage to shareholder value due to security failure’ and poor disclosure as justification for the lawsuit. Korean law firm Daeryun's U.S. subsidiary (SJKP) is also preparing a consumer class action lawsuit against Coupang Inc. Reporter Lee Young-gwan ykwan@chosun.com[View full article] Will the U.S. lawsuit be a ‘detonator’ for Coupang? The law firm that first sued Volkswagen for ‘Dieselgate’ joins the company

(Seoul = News 1) Reporter Han Soo-hyun = Coupang independently announced its own investigation results without consulting with the government and investigative agencies in relation to the customer information leak, amid continued criticism that it was a 'self-investigation', and executives including Coupang Inc. Chairman Kim Beom-seok were additionally sued for obstructing the investigation. According to the legal community on the 26th, Jihyang Law Firm represented the victims of Coupang's customer information leak and filed charges against top executives, including Chairman Kim and Coupang CEO Harold Rogers, for obstruction of official duties. They announced that they had submitted a complaint to the Seoul Metropolitan Police Agency on charges of destruction of evidence and obstruction of business. Coupang announced in a press notice the previous day (25th) that this personal information leak incident was the sole crime of one former employee. Coupang said that, as a result of its own investigation, the employee had accessed the information of 33 million customers, but only stored the information of 3,000 accounts separately. However, while the public-private joint investigation team and police investigation are currently underway, the issue was raised that Coupang unilaterally announced the results of the investigation and announced them as if they were the results of an official investigation. The reliability of the announcement was also pointed out. Jihyang believed that Coupang's investigation and announcement of results was an attempt to interfere with the government's official investigation and work and systematically conceal the crime, and filed an additional complaint. Jihyang said, "Coupang's announcement of a 'self-investigation' is an act of deceiving both state agencies and the 33.7 million affected people," and pointed out, "It cannot be an act to neutralize the national response and mislead the investigation, rather than simply providing information." He added, "All responsibility falls on the former employee." “It was defined as a single crime committed by a single person, and the intention was to fundamentally block the possibility of systematic intervention or systemic security failure and reduce the scope of the investigation,” he said. “We cannot erase the suspicion that this is a typical ‘tail-cutting’ attempt to conceal the background of the incident and avoid top management’s responsibility.” In particular, Ji-hyang pointed out that it was a “serious act of obstruction of justice” when former employee A claimed to have personally recovered the laptop that was thrown into the river. “It is an attempt to preempt and contaminate the evidence, and it is an advanced tactic to confuse the investigation by damaging the evidentiary power and probative power of the original evidence and submitting contaminated evidence to the investigative agency,” he said. He continued, “Coupang directly interfered with the important self-protection task of responding to emergencies of each citizen by creating a false sense of security, and exposed 33.7 million citizens defenselessly to the possibility of paralysis of social life, such as massive smishing damage or account freezes.” He emphasized, “We must immediately ban all Coupang executives and employees from leaving the country, and quickly initiate a mandatory investigation, including search and seizure of the office and residences of those involved.” He added, “Chairman Kim, who is staying in the U.S., must be immediately summoned and investigated, and if he fails to comply, all means, including international criminal justice cooperation, must be taken.” Meanwhile, despite Coupang’s unilateral announcement, group lawsuits filed by Jihyang, Daeryun Law Firm, and LKB Pyeongsan are scheduled to proceed without change. Jang Ji-woon Attorney Dae-ryun said, "The fact that Coupang investigated first without handing over the identity of the secured distributor to the investigative agency raises suspicions of destruction of evidence and is highly likely to encourage distortion of the truth. It has no impact on future group lawsuits or criminal complaints." He added, "As the investigative agency is conducting the investigation, it is unlikely that the state agency will trust or cite the results of the suspect's own investigation, Coupang." He added, "The results of Coupang's investigation and the facts revealed through future investigations are unlikely to differ." “In this case, Coupang’s responsibility, including allegations of posthumous concealment, will only increase,” he added.[View full article] “Coupang’s announcement of its own investigation is obstruction of the investigation”… Chairman Kim Beom-seok additionally sued

A man who was involved in a 'currency exchange phone financial fraud (voice phishing)' crime while looking for a loan to cover his mother's medical expenses was acquitted. According to the legal community on the 26th, the Seoul Eastern District Prosecutor's Office decided not to indict Mr. A, a man in his 50s who was sent on charges of telecommunications financial fraud on the 13th of last month. Mr. A was deceived by an unidentified member of a telephone financial fraud organization last January and deposited money into his account by Mr. B. He was suspected of exchanging 15 million won into 6,000 dollars and 630,000 yen and delivering them to a gang member. Mr. B was deceived by a member of a telephone financial fraud organization who said, “You must make a deposit to receive a loan,” and deposited the money into Mr. A’s account. Mr. A denied the charge. He claimed, “I was simply deceived by the loan officer who offered currency exchange and transfer, saying, ‘If you want to issue a loan with company support funds, you need track records.’” He also explained, “There were questionable parts during the loan screening process, such as asking to take pictures and send them, but I had no idea that it was a phone financial fraud because I needed my mother’s medical expenses urgently.” The prosecution concluded that Mr. A only exchanged money twice over two days and that he immediately complained to the loan manager when his account was suspended, so he only trusted and followed the loan manager’s instructions and did not intentionally participate in the crime of phone financial fraud. Kim Sang-gu Law Firm, who represented Mr. A, Attorney Dae-ryun said, “Mr. A went to the police for consultation as soon as his account was suspended, and was able to get the charges acquitted by actively explaining that he did his best to restore the situation to its original state, including paying a settlement to Mr. B despite difficult economic conditions.” Reporter Jeong Cheol-wook[View full article] 50-year-old not guilty in connection with phone fraud while trying to borrow money for mother's medical expenses

Ms. A received punishment from the School Violence Commission for causing school violence to three of her friends. Court said, "Most of the acts are not recognized as school violence...an abuse of discretion." A teenager who had been disciplined for being a perpetrator of school violence filed a lawsuit against the educational authorities to cancel the punishment and won. On the 11th of last month, the Uijeongbu District Court ruled in favor of the plaintiff in the lawsuit filed by teenager A against the superintendent of the Gyeonggi-do Guri Namyangju Office of Education to cancel the punishment for a school violence offender. Previously, the Uijeongbu District Court ruled in favor of the plaintiff. Last year, Ms. A was identified as a perpetrator of school violence by three friends from the same school. She was cited for reasons such as intentionally alienating certain people from her group of friends, creating a SNS group chat room with the exception of one person to gossip about them behind their backs, or causing embarrassment in public places. Accordingly, the School Violence Countermeasures Review Committee ordered Ms. A to perform 3 hours of school volunteer work, complete 2 hours of special education, and prohibit contact, threats, and retaliation against the victim until graduation. They protested against the school violence committee's decision. The school violence committee made its decision based on facts that were not true, and some of the plaintiff's actions could not be viewed as school violence beyond everyday fights or conflicts that occur in peer relationships. In addition, both parties claimed that the school violence committee deviated and abused its discretion in the process of considering the intentionality, seriousness, and persistence of school violence, such as gathering all cases with different periods, characteristics, and parties into one for deliberation. The court ruled in favor of both parties. There were a total of ten acts by Ms. A that the School Violence Committee used as the basis for disposition, and most of them were recognized as school violence even though they were acts that could not be evaluated as school violence as defined by the School Violence Prevention Act. The court also said, "The defendant evaluated the plaintiff's actions toward each victim as bullying on a continuous basis, but the actions toward two of the three victims cannot be recognized as school violence." The court also said, "The actions of two of the three victims cannot be recognized as school violence." He added, "Although one victim appears to have suffered psychologically, we took into consideration the fact that the conflict between the two does not appear to have started from the plaintiff's one-sided harassment." Attorney Kim Ho-jeong of Daeryun Law Firm, who acted as legal representative for Ms. A, said, "The School Violence Commission did not specifically specify the reason for the disposition regarding the content, extent, frequency, or circumstances of the act of school violence." He explained, "I emphasized that I lost it. #Disposition of school violence #Cancellation lawsuit #Court unfairness #Accident Park Seok-ho (haitai2000@ikbc.co.kr)[View full article] Why did the teenager who filed a lawsuit to cancel the school violence case win?

Class action lawsuits in full swing in the U.S. Following consumers, shareholder lawsuits are also underway. As a class action lawsuit is being pursued in the U.S. surrounding Coupang's large-scale personal information leak, the 'discovery (evidence discovery)' system is attracting attention as a key procedure that will determine the success or failure of the lawsuit. There are predictions that the U.S.-style litigation structure, which, unlike in Korea, allows forcibly securing internal company data, will be a watershed in dividing the scope of responsibility of Coupang's headquarters. According to the legal community on the 23rd, SJKP, the U.S. branch of Daeryun Law Firm, plans to file a consumer class action lawsuit against Coupang Inc, Coupang's parent company, in New York federal court at the end of this month or early next year after completing the recruitment of plaintiffs. Daeryun explains that the core of the lawsuit is to determine whether the headquarters was responsible for security investment and internal control rather than the personal information leak itself. Coupang I&C, listed on the U.S. stock exchange, is the parent company that owns 100% of Coupang Korea Corporation. The strategy put forward by SJKP is the American discovery system. Discovery is a process in which documents and electronic information held by the other party are compulsorily submitted prior to the trial on the merits, and can even include company internal data such as board meeting minutes, internal reporting data, security budget decision documents, and email and messenger records from the incident response process. SJKP's position is that through this, it will confirm whether Coupang's headquarters took appropriate response or management/supervision measures after the personal information leak incident. The legal world believes that discovery itself can be a significant burden on companies. Kang Dong-hee, an attorney at Yoon & Yang Law Firm, explained, “Unlike Korea’s document submission order, U.S. discovery allows for extensive internal data acquisition and even includes testimony from executives and employees in the process,” adding, “It can also be used as a means of pressuring companies to reach an early agreement.” Some analyzes say that Discovery's impact could be greater in shareholder class action lawsuits than in consumer lawsuits. Lee Eun-woo, a lawyer at Hyangyang Law Firm, said, “Discovery means preserving related data rather than deleting it before the full-scale evidence begins,” and predicted, “In this case, the impact through a shareholder class action lawsuit may be greater than that of the victims of domestic information leaks.” As a shareholder class action lawsuit is a case in which the amount of damage is large and law firms invest intensive manpower and resources, the explanation is that internal documents and the contents of witness interviews secured through a full-scale discovery process after the data freeze can be key evidence in determining who is responsible. Currently, in the United States, apart from consumer lawsuits, a class action lawsuit is being pursued centered on shareholders who suffered damage from the stock price drop due to Coupang's personal information leak. We the People Law Firm has begun recruiting litigants to file a shareholder class action lawsuit in New York federal court, and is considering the timing of recognition of the information leak incident and whether there is a delay in disclosure as key issues. The law firm believes that Coupang did not fulfill its obligation to disclose personal information in a timely manner as required by the U.S. Securities and Exchange Commission (SEC) even though it was aware of the personal information leak. In addition, in the business report submitted in February of this year, it is said that key information regarding the 'possibility of cyber security threats having a significant impact on the company' was falsely or poorly disclosed. If a company's reputation or customer trust is damaged due to a cyber security incident, the SEC considers it a 'serious incident' and stipulates that it is subject to disclosure. The legal community believes that the possibility that failure to disclose the leak in time or to minimize the risk may fall under these standards cannot be ruled out.[View full article] ‘Discovery’ emerged due to the Coupang incident… It became a key strategy in U.S. court lawsuits [Evidence discovery system, changing the game] (Shortcut)