On Thursday, Coinbase, the largest cryptocurrency exchange in the US, reported that criminals had improperly accessed personal data belonging to its customers. This data is believed to be tied to fraudulent activities involving crypto theft, and the hackers demanded a ransom of $20 million to prevent the information from being released.
In a statement, Coinbase CEO Brian Armstrong noted that some of the attackers had bribed customer service agents from overseas to obtain sensitive information, such as customer names, birth dates, and partial Social Security numbers.
“The stolen data can facilitate social engineering attacks,” Armstrong explained. “These attacks can enable impersonators to pose as Coinbase customer support, tricking customers into transferring funds.”
Social engineering remains a prevalent hacking method, exploiting the fact that human errors are often the weakest link in cybersecurity. Several major companies have experienced data breaches in recent years due to these tactics.
While Coinbase did not disclose the specific number of affected customers, the company assured that it would reimburse those impacted.
According to a filing with the Securities and Exchange Commission, Coinbase estimated that addressing this issue and providing refunds could cost between $180 million and $400 million.
The SEC document revealed that the company discovered last month that certain customer service agents had accessed data that was not necessary for their work. These employees have since been dismissed, and Coinbase has enhanced its fraud prevention measures.
On Sunday, the company received an email from the attackers, who stated they would release the stolen customer data unless their demand for a $20 million ransom in Bitcoin was met.
Armstrong mentioned that Coinbase chose not to pay the ransom. Instead, the company is offering a $20 million reward to anyone who can provide information leading to the arrest of the attacker.
“We will pursue those who seek to harm Coinbase customers and ensure they face justice,” Armstrong stated. “This is my message to those individuals.”
