Coinbase Insider Breach Exposes Limited Customer KYC Data via Support Tool Access

Coinbase confirmed an insider data breach in which a single contractor improperly accessed customer information affecting approximately 30 customers. Coinbase said its security team detected the activity, the contractor no longer provides services to the company, impacted users were notified, and identity theft protection was offered; Coinbase also reported the incident to relevant regulators.

The disclosure followed brief Telegram posts by threat actors showing screenshots of an internal Coinbase support interface that appeared to expose access to sensitive customer data, including names, email addresses, phone numbers, dates of birth, and KYC information (and, per the leaked interface screenshots, potentially wallet balances and transaction details). Reporting indicated the incident is separate from the previously disclosed TaskUs-related insider breach, and it remains unclear whether the group that posted the screenshots (reported as “Scattered Lapsus Hunters”) conducted the access or merely obtained and shared the data; the incident highlights ongoing targeting of BPO/contractor ecosystems due to their privileged access to internal tools and customer records.