Coinbase faces data breach and extortion; refuses to pay ransom

Cryptocurrency exchange platform Coinbase has recently been the victim of a data breach, revealing that attackers have obtained customers’ data, potentially putting them at risk of social engineering attacks. The breach was reported to the US Securities and Exchange Commission (SEC) by Coinbase, confirming the compromise of customer data by a group of malicious support agents within the company.

The attack did not involve the compromise of Coinbase’s systems or networks but rather involved the bribing of customer support agents to access and share customer data with the attackers. The attackers aimed to gather a customer list to impersonate Coinbase and deceive people into handing over their cryptocurrency, following up with a demand for a $20 million ransom from Coinbase as an attempt to cover up their actions. In a surprising turn of events, Coinbase declared that they did not and will not pay the ransom but would instead establish a $20 million reward fund for information leading to the arrest and conviction of the attackers.

The compromised data shared in the ransom email included customers’ personal information such as names, addresses, phone numbers, email addresses, the last four digits of their Social Security numbers, masked bank account numbers, bank account identifiers, images of government-issued IDs, and some account data like transaction history and account balance snapshots. However, the attackers did not have access to more critical security details such as login credentials, 2-factor authentication codes, private keys, hot or cold wallets, Coinbase Prime accounts, or the ability to move or access customer funds.

In response to the breach, Coinbase has taken several measures to mitigate the impact on its customers and enhance security moving forward. They have terminated the rogue support agents involved, notified potentially affected customers, and set up additional security controls and monitoring to detect insider threats across all company locations. Additionally, they have introduced extra protections for the accounts of fewer than 1% of monthly transacting users whose data was compromised and are pressing criminal charges against the fired employees involved in the breach.

Coinbase has advised its customers to remain cautious and vigilant against scam attempts, emphasizing that legitimate Coinbase employees would never ask for sensitive information like passwords or 2FA codes. Moreover, they have assured customers that they will reimburse retail customers who mistakenly sent funds to the scammers as a result of this incident and are working to track and recover the stolen funds. Despite the breach, Coinbase remains committed to ensuring the security and integrity of its platform and continues to collaborate with authorities to address the breach and hold the culprits accountable.