Security researcher calls BS on Coinbase breach disclosure timeline

A security researcher says Coinbase knew about a December 2024 security breach during which miscreants bribed its support staff into handing over almost 70,000 customers' details at least four months before it disclosed the data theft. The researcher, Jonathan Clark, says he knows this for a fact because he reported the attack to Coinbase on January 7 after the criminals tried to scam him. According to Clark, Coinbase's Head of Trust and Safety Brett Farmer responded to his "comprehensive security report" the same day he emailed it to the company's security@ address. In a blog about the incident, Clark says Farmer replied: "This report is super robust and gives us a lot to look into. We are investigating this scammer now." And then, he says, he never heard another word from Coinbase, despite four follow-up emails sent in January. As a refresher: In May, Coinbase disclosed the breach to the US Securities and Exchange Commission. At the time, the company said the data thieves stole 69,461 people's private and financial information, including their name, date of birth, the last four digits of their Social Security number, address, phone number, email address, driver's license number, passport number, national identity card number, transaction history, balance, transfer, and the date customers opened their accounts. Coinbase said the breach took place on December 26, 2024, but wasn't discovered until May 11. The crooks also tried extorting the company for $20 million. Clark dispu...