‘United States public announcement’ only 4 hours before the hearing… A serious accident now?

Coupang reported this personal information leak to the U.S. Securities and Exchange Commission only four hours before the hearing. There are criticisms that the report was delayed to reassure American investors. The CEO of Coupang, who appeared at the hearing, said that although reporting was not mandatory, he made the announcement due to great interest.

Reporter Choi Seung-hoon looked into whether this claim was true.



This is Coupang's public report released to the U.S. Securities and Exchange Commission (SEC) at 6:13 a.m. today (the 17th), our time.

It was titled 'Significant Cybersecurity Incident' in Rogers' name.

On the 18th of last month, we were aware that personal information, including up to 33 million customer names and phone numbers, had been leaked, and we wrote that Korean regulators were likely to impose financial penalties.

Representative Rogers appeared at the hearing about four hours later and argued as follows.

[Harold Rogers/CEO of Coupang: This type of information is not an incident requiring reporting under the U.S. Personal Information Act. So we had no obligation to disclose it.]

Although there was no obligation, he said he made the announcement “because we took into account the fact that it is a situation that continues to attract attention.”

Is that really the case?

If a U.S. listed company determines that a security incident is serious, it must report it to the SEC within 4 days on a form called 8-K.

The Coupang report released today has the title “Significant” and was written in 8-K form.

It is pointed out that it is inconsistent to claim that there was no obligation to disclose a report that was submitted in accordance with a disclosure obligation.

[Son Dong-hoo/Attorney, New York State, USA: Major cyber security incidents will (soon) be subject to disclosure. They submitted the 8-K because it has a ‘significant impact.’]

The report does not specify when Coupang judged this accident to be “serious.”

There are also suspicions that they are trying to avoid fines for delayed disclosure by claiming that they knew about the leak a month ago, but decided it was serious only recently.

Amid growing criticism, Bae Kyeong-hoon, Deputy Prime Minister for Science and Technology, announced that he was discussing with the Fair Trade Commission the suspension of Coupang's operations.

(Video editing: Jeong Seong-hoon, design: Jang Ye-eun)

Reporter Choi Seung-hoon noisycart@sbs.co.kr

[View full article]
'US public announcement' only 4 hours before the hearing... A serious accident now? (Shortcut)