Former Coinbase Support Agent Arrested in India Over Insider Data Breach
Published
Key Takeaways
- Insider Threat: Authorities in India have arrested a former customer service agent for allegedly facilitating unauthorized access to Coinbase's internal systems.
- Data Exposure: The breach compromised sensitive PII and KYC documentation of approximately 69,500 users.
- Enforcement Action: This arrest marks a development in the ongoing investigation into the May 2025 incident involving bribed outsourcing employees.
A former Coinbase customer support representative was arrested by law enforcement officials in Hyderabad, India. The unnamed individual is accused of collaborating with cybercriminals to exfiltrate sensitive user information from the American cryptocurrency exchange and financial services company's database earlier this year.Â
Arrest Follows Investigation into Insider Facilitation
This action follows a cryptocurrency data breach initially disclosed by Coinbase in May 2025, where rogue employees at an outsourcing partner, TaskUs, were bribed to grant system access to external threat actors.Â
In subsequent disclosures, Coinbase acknowledged that unauthorized access by other, unnamed overseas support agents was implicated in the data breach.
Coinbase CEO Brian Armstrong has indicated that one further detention is anticipated as the investigation proceeds.
Scope of the Coinbase Customer Data Leak
The incident exposed a critical vulnerability within the support supply chain. The Coinbase customer data leak affected roughly 69,500 customers, compromising highly sensitive Personally Identifiable Information (PII), including names, dates of birth, physical addresses, and the last four digits of Social Security numbers.Â
Furthermore, the breach involved the theft of scanned documents related to "Know Your Customer" (KYC) compliance protocols. The attackers originally demanded a $20 million ransom to withhold publication of the stolen data, a demand the company refused.
In response to the incident, TaskUs terminated the involved personnel and ceased operations for the specific department associated with the breach in January.Â
This month, law enforcement dismantled a €700 million crypto fraud and laundering network and the Cryptomixer laundering service.
Related
Get expert insights on threats, breaches, scams, and security trends — delivered every Saturday.
Most Popular
Get expert insights on threats, breaches, scams, and security trends — delivered every Saturday.
Most Popular