support agents can see customer data, but they can't take it anywhere

what everyone assumed

Support needs to see customer accounts. That is the job: answer questions, check a transaction, confirm an identity. The agents work inside internal tools, with no way to export the database, and the tools log what they open. Customer data stays inside the company’s systems while support looks at it.

what happened

In a filing with the US Securities and Exchange Commission on 15 May 2025, Coinbase said a threat actor had paid multiple contractors or employees working in support roles outside the United States to collect information from internal Coinbase systems they had access to in order to perform their jobs. Coinbase said its security monitoring had detected that access, without a business need, in the previous months, and that the people involved had been terminated.

On 11 May 2025 the group emailed Coinbase demanding $20 million in exchange for not publishing the data. According to the filing, it included names, addresses, phone numbers and email addresses, the last four digits of social security numbers, masked bank account numbers, images of government ID such as passports and driving licences, account balances and transaction history. Coinbase said passwords, private keys and customer funds were not exposed. The company told the Maine attorney general that 69,461 people were affected, according to TechCrunch.

Reuters reported in June 2025, citing five former employees of the outsourcing firm TaskUs, that a TaskUs agent in Indore, India, had been caught photographing her screen with a personal phone, and that Coinbase had known of the leak since January 2025. In a class action, plaintiffs allege that she kept data on more than 10,000 customers on her phone and was paid $200 per photo, according to Fortune. These are allegations. In late December 2025 Coinbase’s chief executive announced the arrest of a former support agent in Hyderabad.

how it surfaced

Coinbase’s own monitoring found the lookups first, months before the extortion email, and the company fired the agents involved. The ransom email in May is what made it public. Coinbase refused to pay, offered a $20 million reward for information leading to the attackers, and promised to reimburse customers tricked into sending funds by people using the stolen data.

In its 8-K Coinbase estimated the cost of remediation and reimbursements at between $180 million and $400 million. Its shareholder letter for the second quarter of 2025 reported costs of about $307 million linked to the incident.

Anything a support agent can see, someone can pay them to photograph.

Monitoring caught the lookups, and the photos had already been taken. The deciding question was how much each agent could see on one screen.