MisuseFinancial ServicesTechnologyFinancePrivilege AbuseData MishandlingEmployee Data InvolvedCustomer Data InvolvedRansom DemandedIdentity (basic)Government IDFinancial accountMediumContained

COINBASE, INC.

bd_2406100bb1153d9e · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

May 20, 2025

To disclose

—

Affected

Not disclosed

Linked

10 filings

Confidence

65%

Full breach record for COINBASE, INC. →4 incidents on file

Coinbase, Inc. disclosed that a small number of individuals performing services at overseas retail support locations improperly accessed customer information, including personal identifiers, government ID images, and account details. The incident occurred on December 26, 2024. Coinbase fired the involved individuals, referred the case to law enforcement, and implemented enhanced security controls. A third party attempted to extort $20 million, which Coinbase refused to pay, instead creating a reward fund. Affected customers are offered credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

Dec 26, 2024

Begins

May 20, 2025

Filed

This filing is one of 10 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (9) · sorted by filing gap

Montana State AGbd_6fcf4d20742c3a722025-05-20Verified
Washington State AGbd_7388d192de2195c02025-05-20Verified
Maine State AGbd_b45c155746e8d50c2025-05-20Verified
Massachusetts State AGbd_fa2703e77095dfa82025-05-20Verified

Show 5 more filings ↓up to 19d gap

SEC 8-Kbd_6b9a0642ea872c252025-05-15 · +5dCandidate
New Hampshire State AGbd_bc2dd2c7c34bf3fe2025-05-27 · +7dVerified
Indiana State AGbd_a3874b13126e95f92025-05-30 · +10dVerified
Nebraska State AGbd_eb31106dc74935862025-05-30 · +10dVerified
Illinois State AGbd_a0715ceb81713b592025-05-01 · +19dCandidate

Name: COINBASE, INC.
norm: coinbase
Domain: coinbase.com

Name: COINBASE, INC.
norm: coinbase
Domain: coinbase.com
Industry: Financial ServicesllmTechnologyllm

Discovered: —
Breach occurred: Dec 26, 2024
Materiality determined: —
Notification sent: Jan 2, 2025
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security numberDate of birth
Attack vector: Insider
Threat actor: InternalFinancial
Regulator citations: Referred the case to U.S. and international agencies
Initial access: insider_action

During the incident: Fired the individuals involved
Referred the case to U.S. and international agencies
Flagged accounts now require additional ID checks on large withdrawals
Include mandatory scam-awareness prompts
Working with industry partners to tag attackers' addresses
Creating a $20 million reward fund
Opening a new support hub in the U.S.
Adding stronger security controls and monitoring across all locations
Increased investment in insider-threat detection
Automated response
Simulating similar security threats to find failure points
Offering free one-year credit monitoring and identity protection services provided by IDX
Changes made: Opening a new support hub in the U.S.
Adding stronger security controls and monitoring across all locations
Increased investment in insider-threat detection
Automated response
Simulating similar security threats to find failure points in any internal system
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 10 filings · 9 states

View merged incident ↗

Illinois State AGMay 1 · first

SEC 8-K+14d

Montana State AG+19d

Washington State AG+19d

Maine State AG+19d

Massachusetts State AG+19d

California State AG+19d · this page

New Hampshire State AG+26d

Indiana State AG+29d

Nebraska State AG+29d

Pattern: first filing May 1 (IL), last May 30 (NE) — a 29-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-602952
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 20, 2025
Raw hash: c76c4011782485f51d18a82ebd3dc9c77d23a928a08a4fe300ad3b2f21ba0d4c

Linked disclosures

Regulatory filings (9) · sorted by filing gap

Reporting entityCOINBASE, INC.

Victim entityCOINBASE, INC.

IncidentInsider

Stated responseFired the individuals involved

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov