Coinbase Data Breach: Bribed TaskUs Support Agents Leaked Sensitive User Data

A recent data breach at Coinbase has been traced to bribed customer support agents employed by outsourcing firm TaskUs in India. The incident, which exposed sensitive user data, highlights the risks associated with third-party vendor security and the challenges of securing outsourced operations. According to reports, the breach affected approximately 69,461 users (0.1% of Coinbase’s customer base) and involved leaked names, emails, partial Social Security numbers, transaction history, and ID documents¹.

Incident Overview

The breach was first discovered in January 2025 but publicly disclosed in May 2025 after hackers attempted to extort $20 million in Bitcoin from Coinbase. The company refused the demand and instead offered a bug bounty, a move detailed in their official blog post³. Investigations revealed that TaskUs employees in Indore, India, were bribed to capture screenshots of user data, which were then shared with threat actors. Following the incident, TaskUs terminated 226 employees in Indore².

Technical and Operational Impact

The breach exposed systemic vulnerabilities in third-party vendor oversight. TaskUs agents, reportedly earning between $500–$700 per month, were susceptible to bribery due to low wages⁵. The attackers, suspected to be part of a group called “the Comm,” used social engineering tactics, including impersonating Coinbase representatives, to further exploit the stolen data⁴. The financial impact of the breach was estimated at up to $400 million in potential losses, as noted in an SEC filing¹.

Security Implications and Remediation

Coinbase has since tightened security controls, including transitioning customer support operations to a U.S.-based hub and enhancing monitoring for unauthorized data access³. The incident underscores the importance of rigorous third-party risk management, particularly for organizations handling sensitive financial data. Key remediation steps include:

Implementing stricter access controls for outsourced support teams.
Enhancing real-time monitoring for unusual data access patterns.
Conducting regular audits of third-party vendors.

Conclusion

The Coinbase breach serves as a stark reminder of the risks posed by third-party vendors and the need for robust security measures across all operational layers. While no passwords or private keys were compromised, the exposure of personally identifiable information (PII) has significant regulatory and reputational consequences. Organizations must prioritize vendor security assessments and employee awareness programs to mitigate similar threats.