Coinbase data breach

[Ashawowo(OS)]

Some users personal data was accessed by a hacker through a third party analytics vendor which Coinbase Shares data. No user funds has been recorded as lost.
It's bad enough that users data was breached, it's worse Coinbase is refusing to take responsibilities, trying to shift blame to Amplitude alone.

Coinbase has not had a data breach.

Amplitude, an analytics vendor, experienced a security incident which impacted a small subset of Coinbase customer contact data, among other Amplitude customers.  

We’ve found no evidence of unauthorized access to Coinbase systems, and customer funds were not impacted.

We are notifying impacted customers and regulatory agencies in accordance with our legal obligations.

https://x.com/CoinbaseSupport/status/2115274731310002356

[joniboini]

I'm not sure this is related to a wallet software though. As far as I'm aware, it's about their exchange customers' right? Wouldn't it fit Services Discussion more?

Semantics aside, what constitutes as taking responsibilities in cases like this? We have many examples of companies leaking database and all they did was promising they'll improve their security, asking users to change their passwords, etc. Never heard any of them paid a single cent for that.

[EL MOHA]

Semantics aside, what constitutes as taking responsibilities in cases like this? We have many examples of companies leaking database and all they did was promising they'll improve their security, asking users to change their passwords, etc. Never heard any of them paid a single cent for that.

They didn’t even provided the information earlier when it happened until many of their customers actually started complaining of malicious emails and this is the best way they can come up with the news. Firstly clarifying that it was them that got hacked and the proceeding to writing that they are only sharing the information because of legality.

For me this is another level of carelessness because how can you hand over users data to any third party and still try to prove your own innocence instead of even trying to sympathize with people who you have lost their details that could lead to a wrench attack.

This is another great example of staying away from coinbase.

[tabas]

We have many examples of companies leaking database and all they did was promising they'll improve their security, asking users to change their passwords, etc. Never heard any of them paid a single cent for that.

We saw hardware wallets that have stolen funds of their customers, they never paid anyone for their negligence. And this is a common thing with these companies, they'll not take the blame if they have some service provider which they allowed to access their customers data and won't take the accountability when that third party has been hacked. They shouldn't be sharing any customers data to a third party service provider for any reason. The denial is probably due to avoidance of their $coin's stock price to plummet.

[BABY SHOES]

Not only did Coinbase experience a data leak, according to @WuBlockchain the South Korean exchange Bithumb also experienced a similar thing, there were irresponsible parties accessing their internal mobile groupware, reportedly as many as 38,490 personal information had been leaked.

[1] https://x.com/WuBlockchain/status/2115256600370024657
[2] https://www.yna.co.kr/view/AKR20261028053200002?section=search

Cloth day more and more data leakage... we can not prevent this because they are the ones who have to be responsible, however we should not list more on other centralized platforms, risks like this will indeed continue to occur.

[hugeblack]

The problem with these services is their reliance on third parties for data processing; consequently, whenever an issue arises, they can simply claim that the failure originated with the third party rather than with them yet the end result remains the same.
At the very least, Coinbase should notify those whose data has been leaked, advising them to exercise caution, as the risk of encountering phishing links is high.

[avp2306]

Some users personal data was accessed by a hacker through a third party analytics vendor which Coinbase Shares data. No user funds has been recorded as lost.
It's bad enough that users data was breached, it's worse Coinbase is refusing to take responsibilities, trying to shift blame to Amplitude alone.

Coinbase has not had a data breach.

Amplitude, an analytics vendor, experienced a security incident which impacted a small subset of Coinbase customer contact data, among other Amplitude customers.  

We’ve found no evidence of unauthorized access to Coinbase systems, and customer funds were not impacted.

We are notifying impacted customers and regulatory agencies in accordance with our legal obligations.

https://x.com/CoinbaseSupport/status/2115274731310002356

I think its wrong to drag the name of Coinbase here, especially for using it on title of the thread. Because it can confuse people, particularly those who read only the title. It can possibly make them think that there's an actual data breach happened. While in fact that  exploit only happened to their third party vendor.

But still good to know that there's no funds got affected

Then maybe best to prepare for any possible attacks.

[Oshosondy]

Some users personal data was accessed by a hacker through a third party analytics vendor which Coinbase Shares data. No user funds has been recorded as lost.

It is data that was breached, that is the reason no users funds that were lost. If it is coinbase's users funds that were breached, it would be users funds that would have been lost. This common saying is common to the exchanges when they failed to protect their customers data.

But this is not the first time that Coinbase's users data were lost. You can easily know from the scam phishing emails used to steal funds from Coinbase's users.

[examplens]

I wonder how much time it will take for large systems to adapt to everything that is happening, so that they can preventively check their systems and their security. This is already humiliating for each of the newly hacked

Would it be pointless to initiate a request to open a new board on the forum, "breach", where all such and similar cases will be in one place

[348Judah]

Some users personal data was accessed by a hacker through a third party analytics vendor which Coinbase Shares data. No user funds has been recorded as lost.
It's bad enough that users data was breached, it's worse Coinbase is refusing to take responsibilities, trying to shift blame to Amplitude alone.

Since no user fund has been compromised, they may definitely maintain not being aware of the data breach that took place, most of these platforms cannot protect any of our information on their platform as long as they are there on their server, the best we can do is to prevent having ours sensitive information with any centralized platform, who knows what they can do with the information leak, can it even be possible reason to why we have been having increasing wrench attacks.

[Z-tight]

who knows what they can do with the information leak, can it even be possible reason to why we have been having increasing wrench attacks.

Data breaches generally is the reason for the rise in $5 wrench attacks. The situation in France is a very good example of this, while it was not explicitly a data breach in the sense of an attack, a rogue tax official was guilty of selling sensitive data of crypto owners in France. Other data breaches like that of Ledger, has also led to losses through phishing and probably unreported cases of physical attacks. Kyc is very dangerous and recent events strongly support that statement.

[Lucius]

The problem with these services is their reliance on third parties for data processing; consequently, whenever an issue arises, they can simply claim that the failure originated with the third party rather than with them yet the end result remains the same.
At the very least, Coinbase should notify those whose data has been leaked, advising them to exercise caution, as the risk of encountering phishing links is high.

Any company that really cares about protecting its clients' data will do it on its own, but as we can see, most large companies simply don't care because they know that they are not legally responsible for such data leaks. Things will change if the laws on this issue change, or if users of various services start avoiding companies that ask for all possible data from them, while sharing the same with other companies that are not ready to protect them in the right way.

[Accardo]

I think its wrong to drag the name of Coinbase here, especially for using it on title of the thread. Because it can confuse people, particularly those who read only the title. It can possibly make them think that there's an actual data breach happened. While in fact that  exploit only happened to their third party vendor.

A data breach happened, Coinbase wouldn't take the responsibility directly, rather they'll prefer calling out a third-party to retain user trust, and minimize FUD. Moreover admitting they shared user data to a third party company dragged the company name to this breach.

[coinlary]

You're expecting the almighty coinbase to take the responsibility   that will not happen. We all know they were breached so we can believe that ourselves without listening to whatever they say but they won't because it will affect their business.

These companies need to take users details serious just as the money, if datas are leaked, it could also lead to loss of money , the same thing they are trying to protect. Maybe the government should take that up since they can be controlled by government anyway. Huge fine or something similar should be put on it so they can take em seriously.

[Charles-Tim]

You're expecting the almighty coinbase to take the responsibility  that will not happen. We all know they were breached so we can believe that ourselves without listening to whatever they say but they won't because it will affect their business.

I do not think it will affect their business. You can see how people are after some data breaches in some crypto platforms and hardware wallets? Be it they are one that caused the breach or third-party, people will always be people.

Secondly is that this is not the first time Coinbase users data has been breeched.

People should be very careful and avoid phishing attacks.

What most exchanges avoid the most is funds to be stolen. If data are stolen, they do not care.

It would have been better if people start suing the exchanges if affected by phishing attack.

[OgNasty]

I've never heard of Amplitude and I guess that is a good thing.  Coinbase can't really control the security of it's vendors, so I guess you have to give them a pass here.

It is always scary anytime you hear about Coinbase and any kind of breach.  They are holding so much BTC for so many different entities in crypto.  Blackrock, Strategy, etc...  I think a hack of Coinbase would probably be the worst possible thing that could happen to Bitcoin.  Let us all hope it never happens.

[Stalker22]

I think its wrong to drag the name of Coinbase here, especially for using it on title of the thread. Because it can confuse people, particularly those who read only the title. It can possibly make them think that there's an actual data breach happened. While in fact that  exploit only happened to their third party vendor.
~

There is nothing wrong here.  If it is a vendor that Coinbase has selected, paid, and entrusted with customer information then still on Coinbase.

The headline is not even misleading at all… that is exactly where the buck stops.  If I give my data to Company A and they give it to some sketchy contractor and they leak the data out I do not care the legal semantics of who owned the server.  It is a Coinbase data breach period.

People reading only the title?  Good.  Let them read it and stay cautious.  If you swapped the name Coinbase for Amplitude, nobody would give a fuck about the underlying problem.

[bhadz]

I think a hack of Coinbase would probably be the worst possible thing that could happen to Bitcoin.  Let us all hope it never happens.

We've seen it with binance but I guess you're right that it's going to be worse if it's Coinbase, and that will give a total scare not only to individuals but also to institutions. Knowing that they are a public company, it's going to be really big news if so happens but I hope not. And lately, I'm seeing some hiring about some positions in Coinbase that come up on my social media. I didn't apply for, but I tried to fill out the forms and what if next would be the data of their employees, and whatnot. It's said that they also serve other clients globally but why only specific to Coinbase.

"Amplitude serves 4,900+ paying customers worldwide, including Atlassian, Burger King, NBCUniversal, and Square.

[Darker45]

I think its wrong to drag the name of Coinbase here, especially for using it on title of the thread. Because it can confuse people, particularly those who read only the title. It can possibly make them think that there's an actual data breach happened. While in fact that  exploit only happened to their third party vendor.

But still good to know that there's no funds got affected

Then maybe best to prepare for any possible attacks.

Why is it wrong to drag the name of Coinbase? Whose data were accessed again? Coinbase's data. Whose customers are they? Coinbase's. Who gathered those data? It's Coinbase. Who shared them? Coinbase, again. So, why shouldn't its name be used in the title?

This is just right as this would also serve as a warning to Coinbase users. If somebody reaches out to you, be extra cautious. Please know that a number of Coinbase's customer contact data were breached. Yours might be included. So, there might be communications coming from criminals.

[hugeblack]

Would it be pointless to initiate a request to open a new board on the forum, "breach", where all such and similar cases will be in one place

Honestly, it’s not a bad idea; discussing everything in one topic is better than repeating the same conversations across multiple threads.
Something similar to Wall Observer for tracking and discussing Bitcoin price movements.