Cryptocurrency exchange Coinbase was aware as early as January of a customer data breach linked to an outsourcing partner in India, according to six people familiar with the situation. The breach, which could cost the company up to $400 million, was detailed in a May 14 filing with the U.S. Securities and Exchange Commission (SEC).
The incident involves TaskUs, a U.S.-based outsourcing firm with operations in India. According to five former TaskUs employees, an employee based in Indore was caught using her personal phone to take photos of her work computer. The photos allegedly captured sensitive Coinbase customer data, which was then passed to hackers in exchange for bribes.
Three former employees and an individual with direct knowledge of the matter said Coinbase was notified immediately after the breach was discovered. Reuters was unable to confirm whether any arrests have been made, and local police in Indore did not respond to requests for comment.
The insiders say the woman had at least one suspected accomplice. Following an internal investigation, TaskUs laid off over 200 employees — a mass dismissal that was widely covered by Indian media.
Coinbase has publicly attributed the breach to “support agents overseas” and warned in its SEC filing that the fallout could cost the company up to $400 million. While Coinbase disclosed that some third-party contractors accessed internal data “without business need” months prior, the company said it only recognized the activity as part of a coordinated extortion campaign after receiving a ransom demand on May 11.
In a statement to Reuters on Wednesday, Coinbase said the breach had been “recently discovered” and that it had “cut ties with the TaskUs personnel involved and other overseas agents,” while also implementing tighter security controls. The company did not specify who the other agents were.
TaskUs confirmed in a statement that two employees were terminated earlier this year for improperly accessing client data, without naming Coinbase. “We immediately reported this activity to the client,” the company said, adding that the individuals appeared to be part of a “broader, coordinated criminal campaign” targeting that client and potentially other service providers.
A source with knowledge of the situation confirmed the client was Coinbase and that the breach occurred in January.
Pump Radar
Stock Alerts