Coupang Hacking U.S. Class Action Battle Intensifies... "Korean Subsidiary's Jurisdiction" vs. "U.S. Headquarters' Responsibility"

Coupang requests dismissal of the U.S. lawsuit
"A Korean court is the appropriate forum"
Plaintiffs' side: "The U.S. parent company controls it"

The battle over Coupang's large-scale personal information leak class action is beginning in earnest.

According to the legal community on the 20th, Coupang's legal team submitted a pre-motion letter requesting dismissal of the lawsuit to the U.S. District Court for the Eastern District of New York on the 6th (local time). This is Coupang's first official response since SJKP, a cooperating law firm of the law firm Daeryun, filed a class action early this year on behalf of the personal information leak victims.

According to the submitted brief, Coupang took the position that the substantive party to this hacking incident is the Korean corporation, so legal responsibility cannot be attributed to the U.S. parent company and CEO Kim Bom-suk.

It also argued that the evidence and witnesses related to the case are concentrated in Korea and that users also agreed in the terms and conditions to be governed by Korean law, so the trial should proceed in a Korean court rather than New York.

Citing that the plaintiffs failed to prove specific monetary damage from the information leak, and that it is difficult for a U.S. court's ruling to have effect in Korea, Coupang urged that the Korean group be excluded from the lawsuit and called for dismissal of the lawsuit itself.

In response, the U.S. firm SJKP LLP and the Napoli Shkolnik firm, which are jointly representing the plaintiffs in this class action, submitted a rebuttal reply to the court on the 14th (local time).

The plaintiffs' counsel argued through the reply that, since it is confirmed in Coupang's disclosure materials that the U.S. holding company listed on the New York Stock Exchange and top management led group-wide cybersecurity governance and controlled the subsidiary, there is direct responsibility at the headquarters level.

They emphasized that since New York residents are among the plaintiffs, the plaintiffs' choice of forum should be respected, and that the dismissal motion should be rejected on the basis of U.S. Second Circuit Court of Appeals precedents holding that mere exposure to the risk of identity theft from a targeted cyberattack constitutes substantive legal harm.

They added that the request to exclude the Korean group is a matter to be discussed later at the class certification stage, and is not an issue to be judged at the early stage before discovery.

The two sides are also engaged in a fierce battle of nerves over the future litigation schedule ahead of the full-fledged legal dispute. The plaintiffs' side reportedly proposed to Coupang a schedule plan allowing 90 days for the plaintiffs to prepare a rebuttal brief after Coupang submits its dismissal motion, but Coupang is said to have withheld explicit agreement.

In the legal community, there is also an analysis that Coupang's such reserved attitude is a deliberate litigation strategy to shorten the plaintiffs' rebuttal preparation period through the process of persuading the court going forward.

Foreign attorney (U.S.) Son Dong-hoo of SJKP explained, "Coupang is trying to get the lawsuit dismissed by shifting responsibility onto the Korean subsidiary alone, but the parent company and management are highly likely to have been deeply involved in company-wide data security policy," adding, "We will not be swayed by Coupang's litigation strategies such as stalling for time or shortening deadlines, and will thoroughly prove the circumstances of the headquarters' involvement and control through the discovery process that will proceed going forward."

He continued, "The U.S. parent company cannot escape responsibility merely because the victims reside in Korea," emphasizing, "As this is a personal information leak that occurred across borders, we will respond to the end so that all victims can receive substantive relief regardless of nationality or place of residence."

Reporter Kim Jin-ryong (kim.jinryong@mk.co.kr)

[View Full Article]
Coupang Hacking U.S. Class Action Battle Intensifies... "Korean Subsidiary's Jurisdiction" vs. "U.S. Headquarters' Responsibility" (Go to link)