Key Takeaways
- Coinbase is facing six lawsuits after disclosing a major data breach.
- Support agents were bribed to leak sensitive user data in a $20M extortion plot.
- The exchange expects up to $400 million in reimbursement costs.
Coinbase is facing at least six lawsuits after revealing that several of its customer support agents were bribed in a $20 million extortion scheme, leading to a serious breach of user data.
Allegations & legal actions
Filed between May 15 and 16, the lawsuits accuse the exchange of failing to implement sufficient security protocols and mishandling the aftermath of the breach.
In one complaint filed in New York federal court, plaintiff Paul Bender alleged Coinbase:
… failed to implement and maintain reasonable security safeguards.
This exposed millions to the risk of identity theft and fraud.
Details of the data breach
The breach, disclosed on May 15, occurred four days earlier and involved the theft of sensitive information such as names, email addresses, phone numbers, Social Security number fragments, bank identifiers, passports, driver’s licenses, and account activity data.
Criticism of Coinbase’s response
Bender’s lawsuit claims Coinbase’s response was…
… inadequate, fragmented, and delayed.
He said users were not promptly notified and were not offered identity protection or clear guidance.
Additional lawsuits & demands
Other lawsuits echo these claims, with one alleging unjust enrichment, asserting Coinbase underfunded its security measures.
A separate complaint in California asked the court to order Coinbase to delete sensitive user data and hire independent security auditors.
Coinbase’s position & financial impact
Coinbase declined to comment on the legal cases but reiterated that it refused to pay the $20 million ransom and plans to reimburse impacted users.
It estimates those costs could range from $180 million to $400 million.
Aftermath & market reaction
Following the breach, Coinbase terminated customer support agents in India linked to the attack.
COIN shares dropped 7% after the disclosure but recovered 9% the next day to close at $266.
