How 8-K filings count affected people, and when the number arrives

The short answer

In the four filings reviewed here, the count of affected people arrived at different points. Coupang's first 8-K, dated December 16, 2025, gave a ceiling figure. The filing says a former employee may have obtained contact details tied to up to 33 million customer accounts. Its amendment of December 29, 2025 kept the 33 million figure for accounts accessed and added a much smaller one for accounts where data was saved.

Fidelity National Financial (FNF) went the other way. Its early filings gave no count of people. Its second amendment, dated January 9, 2024, says the company notified affected customers, state attorneys general and regulators, and approximately 1.3 million potentially impacted consumers.

Two cases do not make a rule. They show two patterns that a reader of 8-K filings will meet.

What Coupang's first 8-K said

Coupang filed its first report under Item 1.05, titled Material Cybersecurity Incidents. The filing says Coupang Corp., the company's Korean subsidiary, became aware of the incident on November 18, 2025.

The count was in the first filing, but as a ceiling and in accounts, not people. The filing says "up to 33 million customer accounts," and adds that certain order histories were obtained for a subset of the impacted accounts. The filing does not say how many people those accounts belong to.

The filing also says the number could still move. It states that the company was still working on the investigation with outside help.

It gives one reassurance about the data: to the company's knowledge, the former employee has not publicly disclosed what was obtained.

The forward-looking statements section lists a reason the picture could change. It names the company's ongoing assessment of the impacts, "including the potential discovery of additional information related to the Incident."

How Coupang's number changed in Amendment No. 1

Coupang filed an 8-K/A (Amendment No. 1) signed December 29, 2025. It reports two updates the Korean subsidiary issued, on December 24, 2025 and December 28, 2025 (both Pacific time).

The amendment does not replace the 33 million figure. It changes the wording from "up to 33 million" to approximately 33 million accounts "accessed." The investigation to date, it says, indicates that approximately 33 million accounts were accessed.

The amendment then adds a second number that the first filing did not have: approximately 3,000 customer accounts where the perpetrator saved limited data. It also says that data was deleted without having been shared with a third party.

A reader tracking "how many were affected" now has two figures in one filing, and they measure different things: accounts accessed and accounts where data was saved. The amendment does not choose one as the headline count of affected people. It also says the investigation is still open and that the updates are furnished as an exhibit.

What FNF said before it had a count

FNF used Item 8.01, titled Other Events, not Item 1.05. The filing says the company became aware of a cybersecurity incident on November 19, 2023.

Amendment No. 1 is the first FNF filing in these documents. It says it amends the report FNF filed on November 21, 2023. The documents provided here do not include the text of that original report, so this guide does not describe it.

Amendment No. 1 contains no number of affected people. It does give a containment date and a limit on what the company knew. On impact, it says only that the company is still assessing.

So the filing before a count exists describes the event, the containment, and the assessment still under way. It states no figure and no estimate, and it does not say when one might come.

When FNF gave a number

FNF's Amendment No. 2 is dated January 9, 2024, and its explanatory note says it follows the original report filed November 21, 2023 and the earlier amendment of November 30, 2023.

The count came after the forensic work ended. The filing says the company completed its forensic investigation on December 13, 2023. It then says the company identified and analyzed the nature and scope of the affected systems and data.

The number appears in a sentence about notification, not as a standalone statement of impact. The company says it notified affected customers, state attorneys general and regulators, and approximately 1.3 million potentially impacted consumers. The same sentence says it is providing credit monitoring, web monitoring, and identity theft restoration services.

Amendment No. 2 also changes what the company says about materiality. Amendment No. 1 said the company would keep assessing. Amendment No. 2 says:

What the filings do and do not show

Three points follow directly from the text.

First, the unit differs. Coupang counts customer accounts, in both of its filings. FNF counts potentially impacted consumers. The filings do not explain how the units relate to each other or to individual people, so the two numbers are not comparable.

Second, the order differs. Coupang gave a figure in its first 8-K and then added a second, smaller figure in the amendment. FNF gave no figure in Amendment No. 1 and one figure in Amendment No. 2.

Third, both companies kept an open door. Coupang's amendment says the investigation is ongoing, and its forward-looking statements list the possible discovery of additional information. FNF's forward-looking statements list the company's "potential discovery of additional information related to the incident in connection with this investigation." Neither filing promises that its figure is final.

For a reader logging these incidents, the filings support recording the filing date, the form (8-K or 8-K/A and amendment number), the unit used, and the wording around the number, such as "up to," "approximately," or "potentially impacted." The documents do not support turning any of these figures into a single count of affected people.