Bom Kim’s strategy for a decade was to lose money deliberately. Not through incompetence, but as a plan: spend billions building warehouses, trucks and delivery staff that no other e-commerce company owned, absorb the losses, and wait until the infrastructure became impossible to compete with.
It worked. Coupang became South Korea’s largest online retailer, listed in New York at around US$60 billion, and turned profitable. Then, in late 2025, the company disclosed a data breach affecting tens of millions of customers, and the second phase of the story began.
The dropout who went back
Kim was born in Seoul in 1978 and educated in the United States, graduating from Harvard. He later enrolled at Harvard Business School and dropped out months in to start Coupang in 2010.
The Korean market he entered already had e-commerce. What it did not have was reliability. Kim’s insight was that the bottleneck was not the website but the last mile, and that nobody would own the last mile unless they built it themselves.
Rocket Delivery
Rather than hand parcels to third-party couriers, Coupang bought warehouses, trucks, and hired its own delivery drivers as employees. The promise was next-morning delivery on orders placed late at night.
The capital required was enormous, and SoftBank supplied much of it, including a US$2 billion investment. Analysts spent years questioning whether the losses would ever end. In March 2021 Coupang listed on the New York Stock Exchange in one of the largest debuts by a foreign company, and the red ink eventually turned black.
Today Coupang’s revenue runs into the tens of trillions of won, and it has expanded into food delivery, streaming and fintech.
The breach
In November 2025 Coupang became aware of a data breach that it later disclosed, in which personal data — names, phone numbers, addresses — tied to more than 33 million customer accounts was accessed. Korea’s privacy regulator later said information relating to more than 37 million people had been exposed. A former employee has admitted carrying out the breach.
The consequences have been severe. The company reported the breach to authorities more than fifty hours after identifying it, exceeding the legal reporting window. It announced a compensation plan of roughly 1.7 trillion won, around US$1.2 billion. In June 2026 Korea’s Personal Information Protection Commission imposed a record fine of 625 billion won, about US$403 million — roughly a year of Coupang’s operating profit. A securities class action followed in the United States, a Korean executive resigned, and the company’s founder and former executives face a legal complaint filed by members of the National Assembly.
It has also become a diplomatic matter. A US congressional report accused Korean authorities of discriminating against an American-listed company; Seoul rejected that, saying its handling of the case followed domestic law without regard to nationality.
What this teaches
Owning the hard part is a real moat. Competitors could copy the website in a weekend. Nobody could copy a decade of warehouses.
Planned losses require a believable end state. Kim could articulate exactly what the spending was buying, which is why capital kept arriving.
Scale converts operational failures into national events. A data breach at a small retailer is an incident. At a company serving most of a country, it becomes regulation, politics and diplomacy.
Kim spent fifteen years making Coupang indispensable to South Korea. That is exactly why the country is now holding it to a standard no ordinary company would face.
