Coupang Stock (CPNG) Update: Founder Apologizes Over Data Leak, Analysts Re-Price Risk Ahead of Monday’s Market Open

NEW YORK, Dec. 28, 2025, 5:12 p.m. ET — Market closed.

Coupang, Inc. (NYSE: CPNG) enters the final trading days of 2025 with investors focused on one dominant storyline: the fallout from a widely publicized customer-data leak at its South Korean operations—and the company’s escalating response as regulators, lawmakers, and U.S. plaintiffs’ attorneys press for accountability.

U.S. equity markets are closed Sunday, meaning Coupang shares won’t trade again until Monday’s regular session. But the headline flow didn’t pause over the weekend. On Sunday, Coupang founder and board chairman Bom Kim issued his first public apology for the breach and said a compensation plan for South Korean customers would be announced “as soon as possible,” without providing details. ^[1]

That weekend development lands just days after Coupang shares surged in post-Christmas trading on Friday, when the company’s own update helped ease investor fears that the incident was far more severe than initially believed. ^[2]

Where Coupang stock stands as markets pause

Coupang shares last ended the most recent session at about $24.28, up roughly 6.5% on the day, with extended-hours trading also modestly higher, according to MarketBeat’s consolidated pricing snapshot. ^[3]

Friday’s broader tape offered little help—or harm—to single-stock narratives. Wall Street’s post-holiday session was notably thin and largely unchanged, with the major indexes finishing near flat. ^[4]

Meanwhile, index futures are expected to reopen Sunday evening, setting the tone for Monday’s risk appetite and potentially influencing how momentum names trade into year-end. ^[5]

The latest: Bom Kim’s apology, compensation plan teased

In a statement posted to Coupang’s website and reported by Reuters, Bom Kim apologized for the data breach and pledged investments and reforms to prevent future incidents. He also said Coupang would unveil a compensation plan for South Korean customers as soon as possible. ^[6]

Korea JoongAng Daily reported additional context and direct remarks from Kim, including an acknowledgment that his apology was overdue and that the company’s early communication was inadequate. The outlet also reported that Kim will not appear at an upcoming parliamentary hearing, while other executives are expected to attend. ^[7]

The “what now” for markets isn’t just reputational—it’s financial. Investors will be looking for specifics: who qualifies for compensation, how large the program could be, and whether the plan signals confidence (a contained incident, limited churn risk) or a more material customer-trust repair effort.

What Coupang says happened in the breach—and why regulators matter

Coupang’s official incident update (dated Dec. 25) asserted several points that are now central to both the bullish and bearish cases:

A perpetrator was identified and devices used in the leak were retrieved. ^[8]
The perpetrator accessed 33 million accounts, but retained data from only about 3,000 accounts and later deleted it, the company said. ^[9]
Coupang said the retained data included 2,609 building entrance codes and did not include payment data, login data, or individual customs numbers. ^[10]
Coupang also said it commissioned “three top global cybersecurity firms”—Mandiant, Palo Alto Networks, and Ernst & Young—to conduct forensic investigation work. ^[11]

That said, the regulatory angle remains a swing factor. Reuters reported that South Korea’s Ministry of Science said its investigation was ongoing and had not confirmed Coupang’s claim that leaked customer information had been deleted, criticizing Coupang for disclosing findings unilaterally before conclusions were reached. ^[12]

In other words, investors are currently weighing the company’s version of the facts against the risk that authorities’ final conclusions could differ—potentially affecting penalties, compliance costs, and consumer sentiment.

Why the stock rallied—and what could reverse it

Friday’s move reflected a classic market dynamic: uncertainty about the severity of a cyber incident can weigh on valuation, but clarity can drive a relief rally—especially into thin holiday liquidity.

Investors.com noted that Coupang’s update pointing to a much more limited set of retained data helped push the stock sharply higher on Friday, while also emphasizing that authorities had not yet confirmed the company’s findings. ^[13]

That caveat—official confirmation—is one reason volatility could persist. A contained breach narrative supports the “buy-the-dip” thesis. Any adverse regulatory finding, expanded scope, or customer backlash evidence could revive downside pressure.

Analyst forecasts: price targets trimmed, but many still lean bullish

Wall Street’s near-term read on Coupang has increasingly been framed as a risk-repricing story rather than a demand-collapse story.

MarketBeat’s compilation shows a “Moderate Buy” consensus rating among 11 analysts, with an average 12-month price target of $33.25 (implying substantial upside from recent levels, based on its dataset). ^[14]

Individual moves highlighted in the same dataset include:

Morgan Stanley (Seyon Park): Overweight, price target lowered to $31 from $35. ^[15]
Nomura: price target lowered to $30 from $38 (Buy). ^[16]

A separate “The Fly” item, republished by TipRanks, attributed Morgan Stanley’s cut to heightened risk after the breach and higher assumed cybersecurity spending, while still expecting limited operational impact. ^[17]

Another major aggregator, Investing.com, also places the average analyst target in the mid-$30s, underscoring that—despite the breach—many forecasts still assume meaningful upside over a 12-month horizon (methodologies differ across platforms). ^[18]

Fundamentals check: Coupang’s growth and cash profile before the breach headlines

Before the breach dominated the conversation, Coupang’s core narrative for many investors was straightforward: strong revenue growth, improving profitability, and increasing scale benefits in its main commerce engine.

In its third-quarter 2025 results, Coupang reported:

Net revenues of $9.3 billion, up 18% year over year (20% constant currency) ^[19]
Net income of $95 million and operating income of $162 million ^[20]
Adjusted EBITDA of $413 million (4.5% margin) ^[21]
Trailing twelve-month operating cash flow of $2.4 billion and free cash flow of $1.3 billion ^[22]
Share repurchases of 2.8 million Class A shares for $81 million during the quarter ^[23]

Segmentally, the same release highlighted Product Commerce’s profitability gains and customer growth, while noting larger losses in Developing Offerings. ^[24]

For investors, those fundamentals can act as a counterweight: the market is asking whether the breach represents a temporary, containable cost line (cybersecurity spend, legal fees, customer credits), or a more structural hit to trust and engagement.

Legal overhang: U.S. securities class action and investor-lawyer alerts

Beyond regulators and lawmakers in South Korea, Coupang also faces legal pressure in the U.S.

Reuters reported that Coupang was sued in a U.S. investor class action alleging securities-law violations tied to the breach, including claims that the company and certain executives misled investors and failed to disclose the incident in a timely manner. Reuters’ report also notes the complaint names Bom Kim and CFO Gaurav Anand. ^[25]

In the last 48 hours, law firms have also issued public investor alerts and releases referencing the case—items that can amplify attention even when they do not add new factual findings. One example: a Hagens Berman release distributed via PR Newswire. ^[26]

What investors should know before Monday’s next session

With the NYSE closed today, Monday’s open becomes a “gap risk” event for CPNG—especially after a strong Friday and a fresh Sunday headline from the founder. Here are the key items likely to shape the first reaction:

Compensation-plan details: Kim said a plan will be announced soon, but size and structure remain unknown. ^[27]
Regulatory confirmation risk: South Korea’s science ministry has publicly stated it has not confirmed Coupang’s deletion claims as its investigation continues. ^[28]
Parliamentary spotlight: Korean media reported Kim won’t attend the upcoming hearing, while multiple executives are expected to appear—an event that could generate new disclosures and political pressure. ^[29]
Analyst re-rating vs. fundamentals: Recent price-target cuts cite risk and added cyber spending assumptions, but many analysts still carry Buy/Overweight ratings and targets above the current price. ^[30]
Year-end liquidity: Late-December trading often brings thinner volumes and sharper moves on headlines—especially for high-beta, news-driven names—while futures’ Sunday reopening can quickly reset sentiment for Monday. ^[31]
Next earnings catalyst: MarketBeat lists Coupang’s next earnings date as estimated (not confirmed by the company), which keeps attention on schedule-based positioning rather than a firm calendar event. ^[32]

Bottom line for Coupang stock (CPNG)

Coupang heads into Monday with momentum from a relief rally, but also with fresh headline risk after Bom Kim’s apology and compensation pledge. The bull case hinges on containment: limited data retention, no payment or login exposure, and manageable costs. The bear case hinges on uncertainty: final regulatory findings, potential penalties, litigation costs, and whether consumer trust erodes more than investors expect.

Either way, CPNG is setting up as a stock where the next leg—up or down—could be driven less by macro and more by the next official confirmation (or contradiction) of the company’s breach narrative. ^[33]