Coinbase Hack Suspect Allegedly Stored Data of over 10,000 Customers on Personal Phone
NEW YORK – A former employee of Coinbase outsourcer TaskUs allegedly kept personally identifiable information (PII) of more than 10,000 Coinbase customers on her personal phone, according to a newly amended court filing in a class-action lawsuit. The revelation marks the most detailed account yet of the data breach disclosed by Coinbase earlier this year – the largest in the crypto exchange’s history.
The lawsuit, brought by law firm Greenbaum Olbrantz, centers on allegations that TaskUs attempted to cover up the extent of the breach. The complaint alleges the suspect, whose name has not been publicly released, accessed and retained sensitive customer data - including names, email addresses, customer support ticket details, and in certain specific cases, transaction histories – on her personal device.
Coinbase disclosed the breach in May, stating that limited customer information was compromised between March and may 2024. The company has since faced multiple lawsuits from affected customers.coinbase has sought to move these cases to arbitration, a process often favored by companies to limit financial exposure and public scrutiny.
Greenbaum Olbrantz opted to sue TaskUs directly,alleging the outsourcer actively worked to suppress information about the incident. The amended complaint cites a former TaskUs employee who claims the company fired 226 staff members in Indore, India, in January as the breach had “so pervasively infiltrated TaskUs’ systems that taskus coudl not identify all of the individuals involved.” Further, the lawsuit claims TaskUs dismissed the human resources team investigating the breach on February 10, characterizing it as “a pattern of concealment.”
“Our amended complaint provides an unprecedented accounting of how this data breach unfolded and we will continue to work towards holding all responsible parties accountable,” said Carter Greenbaum, cofounder of Greenbaum Olbrantz, in a statement.
TaskUs has moved to dismiss the lawsuit and prevent its inclusion in a consolidated complaint encompassing all hack-related claims against Coinbase. Coinbase has also attempted to include the case in the consolidation.
