Live data from Hacker News

Coinbase says hackers bribed staff to steal customer data, demanding $20M ransom

cnbc.com

81–90 of 550 posts

Re: Coinbase says hackers bribed staff to steal customer data, demanding $20M ransom

#81
post #65

Employees at Signal must be getting bribes as well, or even threats of violence since they can get nation state Secret communications these days. Got to make it so employees can’t do anything nefarious. This helps protect them.

How would employees of Signal access the encrypted messages?

Roll out an update that defeats the end to end encryption in some subtle way that wouldn't go noticed for a few days. They'd be told when to do it for maximum effect, and if the window is small enough it might even go unnoticed for far longer when another uncompromised update overwrites it. They have no duty to report such things to relevant authorities even if it was discovered internally, so you could be looking at some corporate coverup that while not in on it, seeks to minimize liability/embarrassment.

Really, can you possibly tell if your Signal messages were compromised? Now that iPhones aren't really jailbreakable, you can't even see inside your own device.

Re: Coinbase says hackers bribed staff to steal customer data, demanding $20M ransom

#82
post #44

Interesting coincidence? >On April 12, Coinbase updated their user agreement to take effect TODAY, May 15, with new language about waiving some rights to class action lawsuits and jurisdiction selection. https://bsky.app/profile/jsweetli.bsky.social/post/3lp7sw647...

The classic added arbitration clause after a massive breach. Happened with Sony and iirc Valve (through Steam) off the top of my head.

Re: Coinbase says hackers bribed staff to steal customer data, demanding $20M ransom

#83
post #49
post #46

Earlier quoted context omitted.

You can do a background check, but the reality of the matter is that you pay citizens a living wage to do the work instead of offshore it into a country that pays pennies. Bank tellers can take thousands out of the vault at any time and yet it seems it’s not a very big issue.

Bank tellers are constantly surveilled by cameras, security guards, and several-times-daily cash counting, and it's still easy to find accounts of them having stolen significant amounts of money before getting caught. These are all from within the last year: Vannia Chatt: https://6abc.com/post/former-citizens-bank-teller-accused-st... Karen Farrell Tigler: https://www.irs.gov/compliance/criminal-investigation/former.…

Then shift liability and let the insurers take care of it.

With a lot of this online stuff, no matter who gets your password or access to your account it’s you who has to take care of it. Whereas if the bank teller steals from the till it’s not your problem.

Re: Coinbase says hackers bribed staff to steal customer data, demanding $20M ransom

#85
post #17

The article keeps saying overseas employees or contractors, but isn't more specific on who Coinbase entrusted with this sensitive customer PII. The bottom line is Coinbase didn't adequately secure sensitive customer information, and it was leaked. Not, "Gosh, 'overseas' people, what can ya do?"

How can customer support operate without knowing anything about the customer?

CS can validate without knowing the details, the same way you don't enter a password and then check to see if that matches the password in the system.

The fact that they keep blaming overseas customer support is pure blame shifting - you still hired someone and gave them access to all this data, Coinbase!

Re: Coinbase says hackers bribed staff to steal customer data, demanding $20M ransom

#86
From the Coinbase website:

https://www.coinbase.com/en-de/blog/protecting-our-customers...

    What they got

    - Name, address, phone, and email

    - Masked Social Security (last 4 digits only)

    - Masked bank‑account numbers and some bank account identifiers 

    - Government‑ID images (e.g., driver’s license, passport)

    - Account data (balance snapshots and transaction history)
Wow. Why does customer support staff have access to images of the user's passports?

Re: Coinbase says hackers bribed staff to steal customer data, demanding $20M ransom

#87
post #59

The problem is that it seems like the data that leaked is also the data that would be used to do account recovery. And what that means is that 1) If you lose access to your account (through either your own fault, or coinbases fault) that the process of recovering it may not be so straightforward anymore. 2) Hackers can try to “recover” accounts now using this leaked info. This is a huge problem. What coinbase needs a…

> What coinbase needs are IRL offices where you can go and do things like account recovery, and where people trying to steal money can be caught and prosecuted (and makes a huge barrier for the overseas thieves who are usually doing this) That's just a bank.

Beyond the regulatory-dodge and crypto marketing explain to me how Coinbase is NOT a bank

Re: Coinbase says hackers bribed staff to steal customer data, demanding $20M ransom

#88
post #78

Earlier quoted context omitted.

[flagged]

You are writing this as if you know what countries Coinbase's call centers are located in and the role of organized crime in their economies, but you don't actually know either of those things.

Lol, that's because while Coinbase emphasizes its commitment to security and compliance specific details about the geographic distribution of its offshore personnel are not disclosed in its public filings.

Re: Coinbase says hackers bribed staff to steal customer data, demanding $20M ransom

#89
post #66

It's really unfortunate that KYC regulations required Coinbase to have this information in the first place. We should be establishing strong social norms against sharing PII without a legitimate reason; this is not just an individual theft risk but a national security risk. Coinbase doesn't pay into your Social Security account, so they shouldn't have your Social Security number. They don't visit your house, so they…

Let's hear you repeat this position after your Coinbase account is compromised and you're looking for recourse.

Re: Coinbase says hackers bribed staff to steal customer data, demanding $20M ransom

#90

From the Coinbase website: https://www.coinbase.com/en-de/blog/protecting-our-customers... What they got - Name, address, phone, and email - Masked Social Security (last 4 digits only) - Masked bank‑account numbers and some bank account identifiers - Government‑ID images (e.g., driver’s license, passport) - Account data (balance snapshots and transaction history) Wow. Why does customer support staff have access to im…

Spy agencies regulating financial institutions (really): https://news.ycombinator.com/item?id=43996848
Post reply on HN