←back to thread

Coinbase says hackers bribed staff to steal customer data, demanding $20M ransom

(www.cnbc.com)
410 points gpi | 7 comments | 15 May 25 15:52 UTC | HN request time: 1.047s | source | bottom
Show context
rkagerer ◴[15 May 25 20:38 UTC] No.43999086[source]▶
Coinbase seems to be going to great lengths to try and distance themselves from the so-called "rogue overseas support agents".

If they were Coinbase employees or contractors, that means the company basically sold its own data to hackers, who then turned around and demanded a ransom.

Reimbursing duped customers makes sense, as it seems like they would have a pretty straightforward case to make in court that Coinbase's actions led to their loss.

I'm more curious if someone who feels the need to move, change banks, change their email, hire a security detail etc. could successfully sue the company to recover some or all of those costs.

replies(1): >>43999526 #
1. vonneumannstan ◴[15 May 25 21:32 UTC] No.43999526[source]▶
>If they were Coinbase employees or contractors, that means the company basically sold its own data to hackers, who then turned around and demanded a ransom.

This seems like a strange interpretation. If an employee at your company, against policy and likely illegally extracts proprietary data and gives it to hackers in exchange for money you can hardly say that "My company sold it's data".

replies(3): >>43999570 #>>43999635 #>>43999946 #
2. behringer ◴[15 May 25 21:38 UTC] No.43999570[source]▶
In a way you can. A company is its employees. If you want employees with integrity you might need to pay better than bottom dollar employees from the cheapest countries possible.

I once applied for a bank position, and they wanted to run a credit check. If you're in a position of handling money, the company has a responsibility to vet its employees. Do I agree with credit checks? Absolutely not, but the point is, Coinbase is partially responsible and that's why they're refunding duped customers.

How far that responsibility goes is up for debate.

3. rkagerer ◴[15 May 25 21:45 UTC] No.43999635[source]▶
I agree it wasn't authorized, but I should absolutely still be able to hold the company responsible for the damage. My business relationship is with you, not your employees or vendors.

They in turn could go after the perpetrator. If they're using contractors who are cheap, unvetted, untrustworthy or don't carry liability insurance that's their problem and shouldn't excuse them of accountability.

replies(1): >>44005965 #
4. mavelikara ◴[15 May 25 22:21 UTC] No.43999946[source]▶
> This seems like a strange interpretation. If an employee at your company, against policy and likely illegally extracts proprietary data and gives it to hackers in exchange for money you can hardly say that "My company sold it's data".

When an employee ships a new feature, do you say "My company shipped a new feature?"

replies(1): >>44000973 #
5. lkbm ◴[16 May 25 01:20 UTC] No.44000973[source]▶
Did the employee ship the feature this against their employer's will? 'Cause if so, I'm not sure we would say the company shipped it.
replies(1): >>44008204 #
6. vonneumannstan ◴[16 May 25 14:30 UTC] No.44005965[source]▶
I'm not up to date on Tort law but it does seem likely the company has some liability here. I still think it's wrong to say the company did the thing. Someone employed by the company did it of their own volition. The company just gave them the ability to do the thing.
7. vonneumannstan ◴[16 May 25 18:00 UTC] No.44008204{3}[source]▶
If an Amazon Delivery driver murders someone in their home while working would we say "Amazon Murdered an Old Lady" ?