(Photo by Jakub Porzycki/NurPhoto via Getty Images)
It turns out the recent breach at Coinbase affects over 69,000 users, giving the hackers plenty of customers to target with phishing attacks.
Coinbase disclosed the security incident last week, and said that "less than 1% of our monthly transacting users had their records accessed.” But a new notice from the cryptocurrency platform puts the exact figure at 69,461.
Another unsettling detail is that Coinbase says the breach occurred on Dec. 26, 2024 but was not discovered until May 11.
Coinbase revealed the new information as part of required data breach notification to Maine’s attorney general. The company is also sending out letters to affected consumers. The hackers stole customer data by bribing Coinbase’s overseas support agents with cash payments for access. In return, the culprits uncovered customers' names, dates of birth, government IDs, and masked Social Security and bank account numbers.
The cryptocurrency platform says the hackers have been exploiting the stolen information to send phishing messages to victims while pretending to be Coinbase. The goal is to trick unsuspecting users into sending their cryptocurrency to the hackers.
In response, Coinbase plans on reimbursing customers who sent the scammers any money. The company has also been bolstering its cybersecurity while issuing a $20 million bounty for any information that leads to the arrest of the culprits.
The company's data breach letter to affected victims also says: "We are offering you free one-year credit monitoring and identity protection services provided by IDX. The services include credit monitoring, a $1,000,000 insurance reimbursement policy and identity restoration, in the event that you are a victim of identity theft."
An SEC filing from the company estimates that Coinbase will spend between $180 million to $400 million to help pay for the reimbursements and the new cybersecurity investments.
Still, the breach is stirring up concerns the hackers could continue to target Coinbase customers, given the breadth of the information stolen, which also includes users’ addresses, phone numbers, email addresses.
Michael Arrington, the founder of TechCrunch, went as far as tweet that the breach “will lead to people dying. It probably has already.” That’s because criminals have been known to target and kidnap users suspected of holding millions in cryptocurrency.
Arrington added: “Very disappointed in Coinbase right now. Using the cheapest option for customer service has its price. And Coinbase's customers will bear that cost.”
In the meantime, some lawyers are preparing to file a class-action lawsuit against Coinbase for damages from the breach.