The realm of cryptocurrency, celebrated for being decentralized and secure for a long time, was recently rocked by a data breach that led to the leak of personal data on tens of thousands of Coinbase customers. This wasn’t a sophisticated, faceless cyber attack; it is an alarming theft of potentially valuable information from insiders, allegedly from a rogue employee at a customer service center overseas. The fallout from this data theft reveals a tapestry woven from lies, a company trying to act quickly, and a lawsuit on tap.
The Breach at a Glance: An Insider’s Alleged Scheme
Court filings have exposed a disturbing story of a breach affecting the privacy of nearly 70,000 Coinbase users. The breach allegedly caused by Ashita Mishra, a former TaskUs employee. TaskUs was an outsourcing company used by Coinbase to perform customer service jobs in India. Mishra allegedly systematically gathered, through photos taken with her personal phone of information displayed on her work computer, sensitive customer information, such as masked social security numbers and banking information. Along with the various forms of identification, she is accused of apportioning and selling this data to criminals for a price per record, which significantly exceeded the cost of the capture. In this case, this easy, yet destructive, method of acquiring sensitive customer data circumvented complicated digital security systems, thus identifying a prominent vulnerability requiring improvement on the human side of corporate security.
A Sophisticated Hub-and-Spoke Conspiracy
The investigators referred to Mishra’s activity as a part of a “sophisticated hub-and-spoke conspiracy” whereby she and another recruited smaller, separate but disjointed circles of TaskUs employees that were unaware of each other’s involvement. The modular model was a clever way to insulate the larger venture so that if one person was caught, the larger operational construct would remain unaffected. The criminal conspiracy was so well-coordinated, that they had even solicited a ransom of $20 million from Coinbase in exchange for not leaking the data that had been stolen. Coinbase’s refusal to pay the ransom, followed by publicly disclosing the data breach, began the downward spiral of the saga.
Coinbase’s Stance and the Aftermath
After identifying the breach, Coinbase moved swiftly. The company promptly terminated employment of the TaskUs staff and other international agents involved, while also enhancing security controls. The company also issued a robust plan to reimburse affected customers for any funds lost via a social engineering scam resulting from the breach. Estimated remediation costs and customer reimbursements are anticipated to be in the range of $180 million to $400 million. In a brave decision, Coinbase also established a $20 million reward fund for information leading to the arrest and conviction of criminals, prioritizing action against the attackers over the attackers’ demands.
Legal Fallout and Corporate Responsibility
In response to the breach, a class-action lawsuit was filed against TaskUs, alleging failed security practices and a failure to disclose the complete breach. The lawsuit lists various allegations but, at its heart, it contends that TaskUs violated state and federal regulations requiring disclosure of the breach in its regulatory filings while simultaneously arranging a multimillion-dollar buyout. The case underscores the increasing emphasis on holding third-party vendors accountable, and increasingly, corporations face the onus of upholding adequate security stakes not only internally, but external vendors within their supply chain, despite the fact that the internally compounded risk is distributed across numerous third-party providers. The lawsuit sheds greater light on another ongoing investigation; possible limitations on responsible companies’ responsibility to the public and/or federal government for the breaches of data that were with their outsourced partners. It will be interesting to see if the case defines any viable legal protections or precedences for “indemnification” against liability over these types of simple breaches by an outsourced/third-party vendor.
Broader Implications for the Digital World
The Coinbase incident demonstrates the pervasive and changing nature of insider attacks–that even with multiple layers of digital protections, the weakest link in the system is typically an insider in a position of authority with malicious intent. It has caused the tech sector to reevaluate security practices, suggesting companies not only adopt stricter access controls and increase monitoring of employee activity but also to start building a culture of security awareness. For corporations and consumers alike, it is a lesson in due diligence, particularly in regard to not only protecting your own personal data, but to know who else has access.
