The Coinbase breach: when the risk is inside the support desk
No zero-day exploit, no sophisticated malware — just bribes to people who could see customer records. The lesson applies to every business that gives staff or contractors access to data.
By the Xuru Technologies team · 16 May 2025
Key takeaways
- On 15 May 2025 Coinbase disclosed that criminals had bribed contractors and employees outside the US to steal customer data.
- The attackers demanded a US$20 million ransom, which Coinbase refused, offering a reward for information instead.
- Stolen data was used to impersonate Coinbase and trick customers.
- Least-privilege access, monitoring and careful partner selection reduce insider risk.
Most security spending targets outside attackers. This case shows why access inside the organisation — including at suppliers — deserves equal attention.
What happened
As The Register reported, Coinbase said a small number of support agents had been paid to pull customer data from internal systems. The data, including names, contact details and some account information, was then used in social engineering scams. Coinbase said it would reimburse affected customers who were tricked into sending funds.
What it means for businesses
- Access should match the job. Support staff rarely need to see everything about a customer.
- Monitoring catches unusual behaviour such as bulk record lookups.
- Customers need warnings. Tell them how you will and won't contact them.
- Partner choice matters. Ask outsourcing providers about vetting, access controls and audit logs.
What to ask any support or technology partner
| Question | Good answer |
|---|---|
| Who can access our customer data? | Named roles, minimum necessary access |
| Is access logged and reviewed? | Yes, with alerts for unusual activity |
| How are staff vetted and trained? | Background checks and regular security training |
| What happens if something goes wrong? | A documented incident process and prompt notification |
Frequently asked questions
Is outsourcing customer support risky?
Any team with data access carries risk, in-house or outsourced. Strong access controls, monitoring and contracts manage it.
How do I protect customers from impersonation scams?
Publish how you contact customers, never ask for passwords or codes, and verify unusual requests through official channels.
Should small businesses log access to customer data?
Yes, where systems allow. Even simple logs help spot misuse and investigate incidents.
Least access, full accountability.
We build portals and admin areas with role-based access, logging and 2-step logins, so data stays where it belongs.
Websites, payments, digital marketing, AI automation, consultancy and practical technology training — for businesses and aspiring professionals worldwide.
Saturday – Sunday: closed