Coinbase reveals that ‘rogue’ support agents assisted in theft of customer data

Coinbase has revealed that cyber criminals managed to exploit and corrupt their support agents to facilitate the theft of customer data, enabling them to deceive victims into sending money to the attackers. The breach resulted in the compromise of sensitive information such as names, addresses, phone numbers, government IDs, account details, and partial social security numbers of a limited number of users, as disclosed in a blog post on Thursday.

According to filings submitted to the Securities and Exchange Commission, Coinbase received an email from a threat actor on May 11th, claiming to have access to specific Coinbase accounts and demanding a hefty ransom of $20 million to prevent the public exposure of the compromised data. Despite the demands, Coinbase chose not to comply with the blackmail.

In response to the incident, Coinbase has taken swift action by collaborating with law enforcement agencies to conduct a thorough investigation into the security breach. The company has also terminated the implicated personnel involved in the data theft and is determined to pursue criminal charges against those responsible for the breach.

However, it is worth noting that the cyber attackers did not manage to obtain critical login credentials, 2FA codes, or private keys, thereby preventing unauthorized access to any Coinbase accounts or wallets. As a precautionary measure, Coinbase estimates that it may incur significant costs ranging from $180 million to $400 million in compensating affected customers and has announced a $20 million bounty for individuals who can provide valuable leads leading to the arrest of the perpetrators.

In the aftermath of the breach, Coinbase has issued a cautionary statement warning users to remain vigilant as scammers, potentially linked to the cyber incident, may pose as Coinbase employees in an attempt to coerce individuals into transferring funds. Coinbase emphasizes that they will never request sensitive information such as passwords, 2FA codes, or instruct users to transfer assets to new or specific locations, accounts, vaults, or wallets.

This incident serves as a stark reminder of the persistent threats posed by cybercriminals seeking to exploit vulnerabilities within digital systems for their nefarious motives. Coinbase’s commitment to transparency, swift response, and proactive measures to safeguard customer information and financial assets are commendable and reflect a dedication to enhancing cybersecurity protocols within the cryptocurrency exchange landscape. Users are encouraged to exercise caution, remain vigilant, and report any suspicious activity to prevent falling victim to fraudulent schemes orchestrated by malicious actors in the digital realm.