FOLLOW US

Coinbase lawsuits are piling up following a significant data breach that exposed personal information of users after cybercriminals bribed overseas support staff. 

Between May 15 and 16, at least six class-action lawsuits were filed against the crypto exchange. Plaintiffs are accusing the company of negligence, inadequate cybersecurity, and an insufficient response.

These lawsuits have intensified scrutiny on the company, with legal and regulatory consequences likely to follow.

The U.S. Department of Justice is investigating the cyberattack, but Coinbase itself is not under DOJ investigation, according to Reuters.

Class-Action Coinbase Lawsuits Allege Negligence 

One of the first lawsuits, filed in the U.S. District Court for the Southern District of New York by Paul Bender, claims Coinbase failed to uphold basic security protocols and placed users at serious risk of identity theft and fraud.

According to Bender’s complaint, Coinbase did not promptly notify affected users, offer identity protection, or provide timely support.

A separate suit filed by Maine resident Zaal Panthaki and Texas resident Alexander Crous similarly criticizes Coinbase for failing to adequately train and monitor third-party overseas support staff. They allege that the breach revealed systemic security failures.

Here are six lawsuits already filed of anticipated to be filed in response to the breach:

• Paul Bender (New York): Accuses Coinbase of failing to implement basic cybersecurity protocols.
• Zaal Panthaki and Alexander Crous (New York): Blame undertrained offshore support teams and poor vendor monitoring.
• Rosemary Ortiz (California): Claims Coinbase stored unnecessary sensitive user data, worsening the breach’s impact.
• Unnamed plaintiffs (Multiple jurisdictions): Say Coinbase delayed response and did not help users mitigate damage.
• Proposed class action (National): Seeks accountability for lifelong risk of identity theft due to leaked PII.
• Future financial fraud monitoring case (Expected): Anticipates harm as attackers exploit exposed data for phishing scams.

What Data Was Leaked?

While Coinbase stated that private keys and passwords were not accessed, the attackers obtained:

• Full names and addresses
• Email addresses and phone numbers
• Social Security numbers
• Masked account details
• Transaction histories

Such personally identifiable information (PII) is extremely valuable to cybercriminals, as it can be used for phishing, impersonation, and fraud.