Coinbase breach sparks lawsuits alleging inadequate protections

Time to file.

That’s how lawyers across the country are responding to a breach at cryptocurrency platform Coinbase, which the company reported on May 15. That breach, Coinbase said in a blog post, was the result of platform insiders who “abused their access to customer support systems to steal the account data for a small subset of customers.”

Though the breach didn’t involve the theft of information related to logins, keys, or funds, Coinbase said the perpetrators did obtain some personal information including names, addresses, phone numbers, emails, and partial Social Security numbers.

Tactical matters. Coinbase attackers took a strategic approach, recruiting overseas customer support and bribing them to copy customer information, allegedly to “gather a customer list they could contact, while pretending to be Coinbase—tricking people into handing over their crypto,” according to the company.

“They then tried to extort Coinbase for $20 million to cover this up,” Coinbase wrote. “We said no.”

The at least six lawsuits filed between May 15 and May 16, as Cointelegraph reported, include filings in New York and California. Plaintiffs allege that Coinbase didn’t do enough to protect their data and “failed to adequately adopt and train its employees on even the most basic of information security protocols.” Coinbase did not immediately respond to a request for comment.

Part of a pattern. The breach comes after the SEC, on Feb. 27, dismissed a civil enforcement action against Coinbase. In a statement, the SEC said it dismissed the action because a new approach to crypto would involve “engaging the general public,” SEC Acting Chairman Mark T. Uyeda said. The Trump administration’s creation of a Crypto Task Force to assist in the regulation of crypto played a role in the dismissal, the SEC said.

Crypto thieves have increased the creativity of their attacks, as IT Brew reported in April, turning to some social engineering schemes involving Zoom and screen sharing. And the attacks are getting more intense; a Wall Street Journal article on May 17 detailed how some thieves are taking their attacks into the real world, even kidnapping and severing the fingers of crypto-rich victims in order to extort funds.