Coinbase Hacker Sold Customers’ Social Insurance Numbers, Bank Account Information and More in $400,000,000 Breach

A single employee of an overseas customer support center in India allegedly collected the personal information of more than 10,000 Coinbase customers as part of the massive data breach on the exchange that was detected earlier this year.

New court documents allege that Ashita Mishra, an employee at the outsourcing firm TaskUs, agreed to sell highly sensitive Coinbase user data to criminal actors by taking pictures of the firm’s computers.

Mishra allegedly siphoned the data of more than 10,000 Coinbase customers onto her phone.

The court documents, citing a TaskUs employee charged with investigating the breach, indicate Mishra operated as part of “a sophisticated hub-and-spoke conspiracy.”

“According to that employee, Ms. Mishra and an accomplice operated smaller circles of disconnected TaskUs employees who participated in the conspiracy. Upon information and belief, those employees were not aware that others were also working with Ms. Mishra or her accomplice. As a result, the criminals could continue exfiltrating highly sensitive PII from TaskUs even if one of the spokes in the conspiracy was caught.”

A filing with the Maine Attorney General’s Office indicates the breach impacted 69,461 people.

Coinbase notes that hacked information includes names, addresses, phone numbers, email addresses, masked social security numbers (the last 4 digits only), masked bank account numbers, some bank account identifiers, government ID images, account data and limited corporate data.

The company refused to give in to the hackers’ demand and estimates it will pay $180 million to $400 million in remediation costs and voluntary customer reimbursements.

The exchange reportedly told Reuters earlier this year that it had “cut ties with the TaskUs personnel involved and other overseas agents, and tightened controls.”

Generated Image: Midjourney