MisuseFinancial ServicesTechnologyFinancePrivilege AbuseBECTargetedRansom DemandedCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)PIILowActive

COINBASE, INC.

bd_bc2dd2c7c34bf3fe · schema v1 · pii pii-v1

Severity

Low

Discovered

May 11, 2025

Filed

May 27, 2025

To disclose

16 days

Affected

454state residents only

Linked

10 filings

Confidence

65%

Full breach record for COINBASE, INC. →4 incidents on file

Coinbase Inc. notified the New Hampshire Attorney General of an insider threat incident where overseas support employees improperly accessed customer account information. A third party claimed to have obtained this data and demanded a $20 million ransom, which Coinbase refused. Approximately 454 New Hampshire residents were potentially impacted. Coinbase suspended the employees, notified customers, and is offering credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 16 days

May 11, 2025

Discovered

May 27, 2025

Filed

vs. sector median

6 wks faster

This filing is one of 10 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (9) · sorted by filing gap

Indiana State AGbd_a3874b13126e95f92025-05-30 · +3dVerified
Nebraska State AGbd_eb31106dc74935862025-05-30 · +3dVerified
California State AGbd_2406100bb1153d9e2025-05-20 · +7dVerified
Montana State AGbd_6fcf4d20742c3a722025-05-20 · +7dVerified

Show 5 more filings ↓up to 26d gap

Washington State AGbd_7388d192de2195c02025-05-20 · +7dVerified
Maine State AGbd_b45c155746e8d50c2025-05-20 · +7dVerified
Massachusetts State AGbd_fa2703e77095dfa82025-05-20 · +7dVerified
SEC 8-Kbd_6b9a0642ea872c252025-05-15 · +12dCandidate
Illinois State AGbd_a0715ceb81713b592025-05-01 · +26dCandidate

Name: LATHAM & WATKINS LLP
norm: latham watkins

Name: COINBASE, INC.
norm: coinbase
Domain: coinbase.com
Industry: Financial ServicesllmTechnologyllm

Discovered: May 11, 2025
Materiality determined: —
Notification sent: May 30, 2025
Affected individuals: 454state-resident count only
Data types: Identity (basic)PII
Attack vector: Insider
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: InternalFinancial
Regulator citations: Cooperating with federal law enforcementReferring the case to U.S. and international agencies
Initial access: insider_action

During the incident: Suspended the personnel involved
Implemented heightened control restrictions to limit access to sensitive customer information
Notified known customers via email
Sending notification letters to those customers via mail
Offering complimentary credit monitoring and identity protection services
Referring the case to U.S. and international agencies
Opening a new support hub in the United States
Adding stronger security controls and monitoring across all locations
Increased investment in insider-threat detection
Creating a $20 million reward fund for information leading to the attacker's arrest
Changes made: Opening a new support hub in the United States
Adding stronger security controls and monitoring across all locations
Increased investment in insider-threat detection
Simulating similar security threats to find failure points in any internal system
Flagged accounts now require additional ID checks on large withdrawals
Flagged accounts include mandatory scam-awareness prompts
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 days(16 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 10 filings · 9 states

View merged incident ↗

Illinois State AGMay 1 · first

SEC 8-K+14d

California State AG+19d

Montana State AG+19d

Washington State AG+19d

Maine State AG+19d

Massachusetts State AG+19d

New Hampshire State AG+26d · this page

Indiana State AG+29d

Nebraska State AG+29d

Pattern: first filing May 1 (IL), last May 30 (NE) — a 29-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/coinbase-20250527.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 27, 2025
Raw hash: 0f9d6143079ac1d7d662b05d163892b9e0551f31a3ec89245c812e12f477c05e

Linked disclosures

Regulatory filings (9) · sorted by filing gap

Reporting entityLATHAM & WATKINS LLP

Victim entityCOINBASE, INC.

Incidentdiscovered May 11, 2025

Stated responseSuspended the personnel involved

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov