Coupang, which suffered a massive personal information leak, plunged more than 5% on the New York Stock Exchange. But JPMorgan said consumer churn will likely be limited given Coupang's market position.
On the 1st (local time) on the New York Stock Exchange, Coupang (CPNG) closed at $26.65, down 5.36% from the previous session. At one point intraday, the decline widened to more than 7%, and the day's drop was the largest in about a month since the 5th of last month (5.94%). Trading volume surged about 4.5 times from the previous day.
The drop came on the first trading day after it was disclosed that personal information from about 33.7 million accounts had been leaked. As the size of the leak, initially known to be in the thousands, expanded by about 7,500 times, it appears to have negatively affected investor sentiment in the U.S. market.
Wall Street also weighed in on Coupang's situation. According to Reuters, JPMorgan said in a report that Coupang is likely to introduce a voluntary compensation package or face sanctions such as a penalty surcharge from the Korean government, noting that "a significant one-off loss could occur." It also said this would "weigh on investor sentiment in the short term."
In Korea, some expect the penalty surcharge on Coupang could reach as high as the 1 trillion won range. The amended 2023 Personal Information Protection Act allows fines of up to 3% of revenue for violations. Coupang's cumulative revenue for the third quarter this year was about 36.3 trillion won, and excluding revenue from growth businesses with low relevance to the data leak—Taiwan, Farfetch, and Coupang Eats (about 14%)—the related revenue is estimated at about 31 trillion won. On an annualized basis, that implies a theoretical maximum penalty surcharge of 1.2 trillion won.
President Lee Jae-myung also addressed the leak at a Cabinet meeting he chaired on Dec. 2 at the presidential office in Yongsan, Seoul. Lee said, "The damage is massive at about 34 million cases, and it is astonishing that the company failed to even detect the leak for five months after it occurred," and directed, "Relevant ministries should refer to overseas cases to strengthen penalty surcharges and prepare practical measures such as implementing punitive damages."
Even so, JPMorgan said the long-term impact on Coupang will be limited. In the report, JPMorgan said, "Coupang holds a virtually irreplaceable market position in Korea's e-commerce market, and Korean consumers tend to be relatively less sensitive to data breach issues." Therefore, it projected that "potential customer churn will remain limited."