Update (June 4, 1:04 am UTC): This article has been updated to add a response from TaskUs.
Coinbase was reportedly informed in January that customer data may have been leaked by an employee of an outsourcing firm, months before the company publicly disclosed the incident last month.
Part of the breach, which Coinbase publicly disclosed in a May 14 regulatory filing, happened when an India-based employee of the outsourcing firm TaskUs was caught taking pictures of her work computer with her personal phone, Reuters reported on June 3, citing five former TaskUs employees.
The former employees said they were told that the employee and a suspected accomplice allegedly gave Coinbase customer information to hackers for money. Coinbase was reportedly immediately notified of the incident.
TaskUs is an American business process outsourcing company operating in India and was alleged in a lawsuit filed in Manhattan on May 27 to have handled Coinbase’s customer support.
More than 200 TaskUs employees were fired in a mass layoff in January that drew protests and Indian media attention at the time. However, just two specific employees were identified as the main culprits behind the breach, which impacted almost 70,000 customers.
A TaskUs spokesperson told Cointelegraph that it “identified two individuals who illegally accessed information from one of our clients” earlier this year. It did not name the client.
“We believe these two individuals were recruited by a much broader, coordinated criminal campaign against this client that also impacted a number of other providers servicing this client,” the spokesperson said.
“We immediately reported this activity to the client, terminated the individuals involved, and are coordinating with law enforcement. Out of an abundance of caution, TaskUs ceased all Coinbase operations in Indore, India, in early January 2025, impacting 226 teammates,” they added.
Coinbase told Reuters that it had “cut ties with the TaskUs personnel involved and other overseas agents, and tightened controls.”
Coinbase rejected a $20 million ransom demand after hackers leaked user data in mid-May, prompting the firm to go public.
Related: Coinbase hit with wave of lawsuits over customer data breaches
Coinbase did not immediately respond to Conitelegraph’s request for comment.
TaskUs accused of crypto data breach in 2022
TaskUs was accused of a crypto-related data breach in 2022, when Shopify and the firm were sued over alleged failures to protect customer data stemming from a breach of crypto wallet maker Ledger’s servers two years prior.
The lawsuit claimed that Shopify and TaskUs were aware of the data breach for over a week before notifying customers.
Ledger customers remain the victims of scams and phishing attacks following the hack and leak of hundreds of thousands of hardware wallet owners’ personal data.
Magazine: Bitcoin $200K ‘obvious’ breakout, GameStop’s first BTC buy: Hodler’s Digest