Coinbase Flags $400 Million Hit After Disclosing Data Breach Ahead Of S&P 500 Inclusion

The SEC is also reportedly looking into the company for misrepresenting its user numbers in past disclosures.

Coinbase (COIN) shares tumbled over 6% in midday trade on Thursday after the company disclosed a security breach that may cost up to $400 million to resolve and a New York Times report said that the Securities and Exchange Commission (SEC) is still looking into the company. 

The news came just a day after the cryptocurrency exchange became the first digital asset player selected for inclusion in the S&P 500. 

In a blog post, Coinbase said the breach involved a network of “rogue” overseas support agents who were bribed and recruited by cybercriminals. The group accessed sensitive user data and used it in targeted social engineering attacks.

The breach affected less than 1% of the company’s monthly transacting users. Although no passwords or private keys were compromised, the stolen information included names, email addresses, phone numbers, masked bank account details, government-issued ID images, and account balances. 

Coinbase said it discovered the breach months earlier and had already fired the employees involved, alerted impacted customers, and upgraded fraud detection systems.

Hackers demanded a $20 million payment to keep the incident quiet, which Coinbase declined. Instead, the company announced it is creating a $20 million reward fund for tips that lead to the identification and prosecution of those responsible.

“We’re cooperating closely with law enforcement to pursue the harshest penalties possible and will not pay the $20 million ransom demand we received,” Coinbase said.

Meanwhile, the New York Times reported that while the SEC has dropped its lawsuit investigating the company for illegally marketing digital currencies to the public, the company's legal troubles may not end there. 

According to the report, the SEC is still investigating whether Coinbase misrepresented its user numbers in past disclosures. The investigation will examine the company's claims of having more than 100 million “verified users.”

Last week, Coinbase unveiled plans to acquire a foreign exchange platform, Deribit, to support its international expansion. CEO Brian Armstrong said during the company’s earnings call in April that Coinbase aims to become “the number one financial services app in the world” within the next five to ten years.

The company’s official inclusion in the S&P 500 is set to take effect before trading begins on May 19. 

Coinbase’s stock is up more than 2.5% this year and has gained nearly 35% over the past 12 months. 

Editor's note: The article has been updated to include The New York Times report on the SEC's investigation into the company.<

For updates and corrections, email newsroom[at]stocktwits[dot]com.<