Coinbase says hackers bribed staff to steal customer data, demanding $20M ransom

From the Coinbase website:

https://www.coinbase.com/en-de/blog/protecting-our-customers...

    What they got

    - Name, address, phone, and email

    - Masked Social Security (last 4 digits only)

    - Masked bank‑account numbers and some bank account identifiers 

    - Government‑ID images (e.g., driver’s license, passport)

    - Account data (balance snapshots and transaction history)

Wow. Why does customer support staff have access to images of the user's passports?