←back to thread

Coinbase says hackers bribed staff to steal customer data, demanding $20M ransom

(www.cnbc.com)
410 points gpi | 2 comments | 15 May 25 15:52 UTC | HN request time: 0.401s | source
Show context
ArtTimeInvestor ◴[15 May 25 17:01 UTC] No.43996993[source]▶
From the Coinbase website:

https://www.coinbase.com/en-de/blog/protecting-our-customers...

    What they got

    - Name, address, phone, and email

    - Masked Social Security (last 4 digits only)

    - Masked bank‑account numbers and some bank account identifiers 

    - Government‑ID images (e.g., driver’s license, passport)

    - Account data (balance snapshots and transaction history)
Wow. Why does customer support staff have access to images of the user's passports?
replies(7): >>43997026 #>>43997046 #>>43997098 #>>43997560 #>>43998052 #>>43998305 #>>43999396 #
1. walamaking ◴[15 May 25 21:12 UTC] No.43999396[source]▶
I always thought that the government ID photos were claimed to be wiped out immediately after document verification. Guess not.
replies(1): >>43999454 #
2. fckgw ◴[15 May 25 21:21 UTC] No.43999454[source]▶
The attackers bribed customer service agents to hand over data and documents, they were not breached directly. It's possible this stuff may have been handed over before being destroyed.