“Want to pay a bounty than a ransom”: Coinbase on $20 million ransom attempt

Coinbase said the company’s security monitoring in the past few months independently detected instances of such people accessing data, adding that all such instances were part of a single activity that led to theft of data from internal systems in May.

Speaking on the attack vector used, Ishpreet Singh, chief information officer at Black Duck, said, “Regarding security architecture, moving to a zero-trust network model will help them to enforce micro-segmentation. It’s important to carry out advanced security risk training, including social engineering defense training. Sensitive user data should be heavily segmented and encrypted with keys inaccessible to support agents.”

After discovery, Coinbase immediately terminated relevant personnel, strengthened its fraud monitoring measures, and notified affected customers to prevent abuse of exposure to information.