Coinbase breach: Two TaskUs India staffers accessed customer data

Time of India

04-06-2025

Bengaluru: Two India-based employees of US BPO TaskUs illegally accessed sensitive information belonging to their client, Coinbase. These staff members were allegedly part of a larger criminal operation targeting Coinbase, which also affected other service providers working with the cryptocurrency exchange.
The cryptocurrency exchange utilises TaskUs to provide outsourced customer service support from personnel located in India.
Coinbase stated in the US SEC filing that the incident did not involve the compromise of passwords or private keys, and at no time were any of the targeted contractors or employees able to access customer funds. While the company is still investigating, the affected data included names, addresses, phone numbers, and emails, masked social security, govt ID images, and account data.
The security breach was referenced by plaintiff Nelson Estrada, who lodged a complaint in a US court against TaskUs, alleging the company's failure to protect personal identification details of himself and millions of other individuals. Coinbase disclosed in a regulatory filing that it received email communication from an unknown threat actor claiming to have obtained information about certain Coinbase customer accounts, as well as internal Coinbase documentation, including materials relating to customer service and account-management systems.
The threat actor, the filing said, appears to have obtained this information by paying multiple contractors or employees working in support roles outside the United States to collect information from internal Coinbase systems to which they had access.
According to a complaint, Coinbase said the preliminarily estimated expenses to be within the range of approximately $180 million to $400 million relating to remediation costs and voluntary customer reimbursements relating to this incident.
When TOI reached out to TaskUs, the company said, "Early this year, we identified two individuals who illegally accessed information from one of our clients. We believe these two individuals were recruited by a much broader, coordinated criminal campaign against this client that also impacted a number of other providers servicing this client.
" TaskUs said it immediately reported this activity to the client, terminated the individuals involved, and is coordinating with law enforcement.
"Out of an abundance of caution, TaskUs ceased all Coinbase operations in Indore in early January, impacting 226 teammates. Following the investigation, all teammates, excluding the two bad actors, were offered a generous severance package, including six months of pay." TaskUs said, "We place the highest priority on safeguarding the data of our clients and their customers and continue to strengthen our global security protocols and training programmes, including by investing millions of additional dollars in physical and information security."
When TOI reached out to Coinbase, a spokesperson for the company said, "As we've already disclosed, we recently discovered that a threat actor solicited overseas agents to capture customer account information dating back to December 2024. We notified affected users and regulators, cut ties with the TaskUs personnel involved and other overseas agents, and tightened controls. No passwords, private keys, or any other information that would allow someone to directly access customer accounts or funds were exposed, and Coinbase Prime accounts are untouched.
"