CPNG is trading at $19.76 as of April 10, 2026. Barely above half its 52-week high of $34.08.

Here are the numbers.

TTM revenue: $34.5B.

Cash on hand: over $6B.

Operating cash flow: $1.8B.

Free cash flow: $527M.

Gross margin: 29.4%.

2025 net income: $208M, up 35% year over year.

Q4 revenue: $8.8B, up 11% YoY (14% on a constant-currency basis).

Developing Offerings (Taiwan, Eats, Play, Farfetch): 32% growth.

Taiwan's delivery network now covers 70% of the country, with 75% of volume delivered next day.

This is a Fortune 150 company sitting on $6B in cash.

Six Wall Street analysts have an average price target of $31.

Consensus: Strong Buy.

That is 58% upside from here.

So why is it at $19?

The answer is in South Korea.

33.7 Million Records

In November 2025, a massive data breach was confirmed at Coupang. A former software developer walked out with a signing key he had retained from his time at the company. He forged electronic access credentials. Over 11 months, he queried the delivery address page 140 million times. He extracted 33.7 million customer records.

Coupang did not detect a single query from the initial test to the final extraction. Signing keys were found on other active employees' laptops. Security management was porous across the board.

The joint government-private investigation concluded in February 2026: "This was not a sophisticated attack. This was clearly a management failure."

Did Coupang get this wrong?

Yes. There is no defense.

The problem is what happened next.

36 Hours of Emotional Trial

December 17, 30, and 31, 2025. Three rounds of parliamentary hearings were held at South Korea's National Assembly. Six standing committees participated. Thirteen witnesses were called. Over 36 hours were spent in total.

The key witness, Coupang Inc. Chairman Bom Kim, refused to appear for the eighth time. Instead, American executive Harold Rogers appeared as interim CEO of the Korean subsidiary. This is where the hearing changed character.

The first session ran past 13 hours.

Lawmakers fired questions through interpreters while Rogers was repeatedly cut off mid-answer. New questions began before previous ones were answered. When he tried to respond, he was told to answer yes or no.

During one exchange, Rogers said to lawmaker Jung Il-young: "Enough." The next day, lawmaker Kim Young-bae demanded a public apology.

Rogers responded: "You are not giving me the chance to answer. Why did you call me as a witness?" He later clarified: "I do not believe my answers were fully interpreted."

A witness denied the chance to speak for 13 hours made one word of protest. That word became "attitude problems."

Lawmaker Hwang Jung-a: "You don't even know why your stock price dropped. You have no will to defend the company. You are nothing more than Coupang's puppet CEO."

Science and ICT Committee Chair Choi Min-hee: "Mr. Rogers has the nerve to drag the National Intelligence Service into his truth game. Communication with him is impossible."

Then something unrelated to the data breach happened.

The bereaved family of a logistics worker who died in a Coupang warehouse in 2020 appeared at the hearing. A family member collapsed to the floor. The cameras caught it.

Worker safety is a serious issue that deserves its own investigation. But inserting bereaved families into a cybersecurity hearing is not a confused agenda. It is a deliberate staging.

Rogers told lawmakers: "I sincerely apologize." Former CEO Park Dae-jun added: "I feel a heavy sense of responsibility. I personally apologized to the mother last year."

They apologized.

So it is over?

No. In South Korea, it is never over.

They apologized, and were asked to apologize again.

They apologized again, and were told the apology lacked sincerity.

They were told to apologize with more sincerity.

If this pattern sounds familiar, it is not a coincidence.

South Korea has done the same thing to Japan for 70 years.

Japan apologized. Compensated. Established funds.

But every time a new administration took power, South Korea demanded another apology.

After receiving compensation, it demanded again.

When the original victims passed away, their descendants stepped forward to demand apologies on their behalf.

That cycle has repeated for seven decades.

The same framework is now being applied to Coupang. "Apologize." "We did." "It did not feel sincere." "Do it again."

How many times is enough?

What format qualifies as "sincere"?

Who decides?

Does this continue until the earth stops spinning?

An apology is meant to be the starting point for preventing recurrence. It is not the destination.

South Korea spent 36 hours extracting apologies and zero hours fixing the system.

Coupang's 1.7 trillion won ($1.2B) compensation package also drew fire.

Most of it consisted of vouchers redeemable only on Coupang Travel and luxury platform A-Luxe. Lawmaker Kim Woo-young: "This is clearly a form of tying arrangement. It would not be permitted even under the U.S. Class Action Fairness Act."

After the hearings, the Minister of Employment and Labor said: "Before the hearing, I thought Coupang could be fixed. After sitting through it, my first thought was: can this even be fixed?"

Was this a technical conclusion about security architecture?

Or an emotional impression?

A cabinet minister was sharing his "feelings" on the hearing floor.

The Questions That Were Never Asked

South Korea's National Assembly spent 36 hours.

Were the following questions systematically addressed during that time?

Why was the former employee's signing key never revoked?

Why did no validation process exist for forged electronic credentials?

Why were 140 million anomalous queries over 11 months never flagged?

What systems will be introduced to close these three structural gaps?

Are there security standards the government should mandate by law?

If primary damage (data exposure) escalates into secondary damage (identity theft, phishing, financial fraud), is there a response framework in place?

If these questions had been the central agenda for 36 hours, South Korea could have extracted real, structural security improvements from this incident.

Instead, here is what South Korea got:

A meme called "puppet CEO."

The emotional satisfaction of saying "go back to America."

And a camera angle of a bereaved family member collapsing to the floor.

The South Korean government had every right to be angry.

And it spent that anger in the most ineffective way possible.

It also got the facts backwards.

"Why is an American company borrowing money from Korean banks?" lawmakers asked during the hearing.

As if Coupang had been draining Korean capital.

The actual flow of capital went in the opposite direction.

Coupang's funding came almost entirely from outside Korea.

SoftBank Vision Fund invested $3B. The rest came from American and Japanese investors.

That money was brought into Korea to build Korea's logistics infrastructure.

The 1.17 trillion won in domestic bank loans was used to construct warehouses and fulfillment centers inside the country.

Not a single won was sent to America.

Foreign capital brought into Korea.

Infrastructure built in Korea.

Taxes paid in Korea.

50,000 jobs created in Korea.

And the National Assembly told them to go back to America.

If that is not a deliberate framing to manufacture anti-Coupang sentiment, what is it?

What the Market Sees

CPNG price action:

Pre-disclosure (late November): ~$27.

During December hearings: sharp decline.

Mid-January: 52-week low of $16.74.

Current (April 10): $19.76.

What happened in South Korea during this period:

National Assembly approved a formal parliamentary investigation.

Business suspension floated as a possibility.

Cross-government task force assembled.

S&P Global downgraded Coupang's ESG score from 9 to 8.

Consumer Dispute Mediation Committee initiated class dispute proceedings (April 7, 2026).

Maximum possible fine: 900 billion won ($650M).

What happened in the United States during this period:

Five major investors (Greenoaks, Altimeter, Abrams Capital, Durable Capital, Foxhaven) launched a legal challenge against the South Korean government, alleging discriminatory treatment of a U.S. company.

The U.S. House Judiciary Committee subpoenaed Coupang.

Multiple securities class-action lawsuits filed.

What Coupang did during this period:

Announced an AI logistics factory collaboration with NVIDIA.

Named to the LexisNexis Top 100 Global Innovators list for the second consecutive year.

Farfetch posted its first quarter of positive economics since acquisition.

Stock price: cut in half.

Fundamentals: intact.

The gap between the two is the regulatory risk premium.

Q1 2026 guidance:

Constant-currency revenue growth of 5 to 10%.

Product Commerce was growing at 16% before the breach. It slowed sharply in December and fell to roughly 4% in January.

Developing Offerings full-year adjusted EBITDA loss guided at $950M to $1B.

The company explicitly acknowledged that its prior trajectory of annual EBITDA margin expansion will be "disrupted" this year.

The short-term hit is real.

But $6B or more in cash.

Triple-digit growth in Taiwan.

Farfetch turning profitable.

An irreplaceable logistics infrastructure across South Korea.

At this combination, $19 is not a structural discount. It is an emotional discount.

We are not saying buy now. But when the gap between the numbers and the narrative gets this wide, usually one of them is wrong.

Kill Coupang. Then What?

A South Korean poll found that 58% of consumers supported suspending Coupang's business license. During the same period, Coupang's user base declined by just 5.8%.

A population that uses the service while wishing it would disappear. That is not anger. That is proof there is no alternative.

Coupang is the company that divided South Korean e-commerce into before and after. Rocket Delivery created same-day and dawn delivery as the national standard. Hundreds of thousands of small and mid-sized sellers built their businesses on its marketplace. Over 10,000 U.S. brands were connected to the Korean market through its distribution bridge.

This is not a matter of like or dislike. It is a matter of infrastructure.

Should the company face fines?

Yes. Up to 900 billion won is on the table.

Should security system improvements be mandated?

Absolutely.

Should consumers be compensated?

Without question. Class dispute proceedings have already begun, with a resolution expected by early June.

But "apologize, go home, aren't you an American company" is an expression of emotion, not the functioning of institutions.

If 36 hours of hearings produced a meme instead of structural security standards, that is not just Coupang's failure.

It is the failure of South Korea's National Assembly.

It is the failure of the South Korean government.

And it is a signal that South Korea's regulatory maturity has not yet reached the level it believes it has.

Any country can punish a company. How it punishes determines whether the world wants to invest there.

Disclaimer: This content is for informational purposes only and does not constitute financial advice. Always conduct your own research before making investment decisions.