Insider Breach at Coinbase Exposes the Real Risk: Third-Party Access

Coinbase has confirmed a new insider breach, revealing how even a single compromised contractor can trigger a cascade of risk. The incident, which occurred in December, affected approximately 30 customers—but the implications go far beyond that number.

Screenshots of internal support tools leaked on Telegram show just how deep unauthorized access can go: emails, KYC data, wallet balances, and transaction histories.

The Breach Behind the Screenshots

The breach was traced to a Coinbase contractor who improperly accessed sensitive customer data. The individual has since been removed, and affected users were notified and offered identity protection.

This incident is not related to the TaskUs breach from January 2025, but it follows a familiar pattern:

• Threat actors (Scattered Lapsus Hunters) posted and deleted screenshots of Coinbase’s internal support panel.
• The panel exposed full customer profiles, including wallet activity.
• The same group previously claimed to have bribed insiders at CrowdStrike.

The Bigger Problem: BPOs Under Siege

Business Process Outsourcing (BPO) firms are increasingly targeted by attackers—not for their own data, but for the access they hold to others’ systems.

Common attack methods include:

• Bribing insiders with legitimate access.
• Social engineering support staff to grant unauthorized access.
• Compromising BPO employee accounts to reach internal systems.

Recent examples:

• Clorox breach via Cognizant help desk → $380M lawsuit.
• Discord breach via Zendesk support agent → 5.5M users exposed.
• Marks & Spencer and Co-op → ransomware and data theft via support staff.
• Google → social engineering attacks on U.S. insurance firms.

Why This Matters

Outsourced support teams often hold the keys to the kingdom:

• Access to internal dashboards.
• Customer identity data.
• Authentication flows and reset mechanisms.

When these accounts are compromised, attackers bypass traditional exploits and walk straight into the network.

What Enterprises Must Do

• Audit third-party access regularly.
• Segment permissions and enforce least privilege.
• Monitor support tool activity for anomalies.
• Train BPO staff on social engineering and insider risk.
• Establish breach response protocols for third-party incidents.

Final Thoughts

The Coinbase breach is a reminder that your security is only as strong as your weakest vendor. As attackers shift from exploiting vulnerabilities to exploiting people, insider risk and third-party access must become top priorities.