Coinbase customer data stolen, hackers demand $20 million in ransom

Source: Jinshi Data

Coinbase's shares fell on Thursday after the company said it was working with law enforcement to track down a "threat actor" who illegally obtained a large amount of customer personal information by bribing contractors in Coinbase's overseas support positions.

Coinbase's shares fell 7.20%, but it did not disclose how many customers were affected.After detecting the leak a few months ago, the company had notified affected customers and fired the contractor involved.The company emphasized thatcustomer passwords and private keys are always protected by the system, and "at no time can bribed contractors or employees access customer funds."

However, the leaked data includes: name, home and email address, phone number, the last four digits of the social security number, masked bank account number and some account identifiers.What's more serious is thatsensitive information such as images of government identification documents (such as passports and driver's licenses), account balance snapshots, transaction records, etc. were also stolen, even including Coinbase's internal training materials, support staff communication records and other corporate data.

“The threat actor appears to have obtained this information by bribing multiple contractors or employees in support roles outside the United States to collect information from Coinbase’s internal systems that they had access to in order to perform their job duties,” the company said. The company has fired the relevant personnel and “implemented enhanced anti-fraud monitoring measures.”

Coinbase said the data leaks were part of the same hacking operation: “These previous improper data accesses were part of the same operation that successfully exfiltrated data from internal systems.”

The company estimates that it will spend $180 million to $400 million on incident remediation and voluntary customer compensation, and the specific amount may be adjusted based on the impact assessment (it did not specify whether it includes the cost of a new US service center). Coinbase revealed in the incident notification blog that it has established a $20 million bounty fund—the same amount that criminals are extorting, but Coinbase explicitly refuses to pay the ransom and is fully cooperating with law enforcement agencies in the investigation.

Coinbase plans to set up a new support center in the United States and take other precautions.