Coinbase says a security incident at its analytics provider Amplitude exposed contact details for a small portion of its customers, along with data held for other Amplitude clients. The exchange insists its own systems were untouched, but the episode is another example of customer data leaking through a supplier rather than through the front door.
What happened
On the evening of 27 October 2026, US time, Coinbase used its Coinbase Support account on X to respond to rumours of a breach that had been circulating for nearly three hours. The exchange said that Amplitude, a product analytics company it uses, had suffered a security incident that reached a “small subset” of the exchange’s customer contact records. Other Amplitude clients were also caught up in it.
The exchange was firm on one point, telling followers, according to Unchained: “Coinbase has not had a data breach.” It reported no evidence of intrusion into its own systems and said customer funds were not affected. It is notifying affected customers and regulators in line with its legal obligations.
Much is still unknown. Coinbase has not said how many people are affected, which contact fields were exposed, when the problem at Amplitude started or how the data was obtained. Several outlets report that email addresses and phone numbers were among the data, but Coinbase’s own statement refers only to contact data, so that list should be treated as unconfirmed.
A figure of more than 70,000 affected users has been widely repeated. It comes from posts on X, one of them by a person who describes himself as a SlowMist executive. It is not a figure from Coinbase, and Unchained says it could not find any SlowMist report backing it up. Until Coinbase or Amplitude publishes a number, it should be treated as speculation. Amplitude had not published a statement on the incident when those reports appeared, and neither company had answered reporters’ follow-up questions.
The detail
Amplitude sells product analytics. Organisations embed its software development kits in websites and apps to see how people use features and where they drop out. To join that behavioural data to real customers, many organisations also send identifiers to the analytics platform. Sometimes those are internal IDs; more often than privacy teams would like, they are email addresses or phone numbers.
That second pattern is what makes an incident like this possible. The analytics vendor becomes a second store of customer contact data, usually managed by product and marketing teams rather than security, and often missing from the data maps that the data protection officer relies on. If the vendor’s platform or a client’s keys for it are compromised, the data can be taken without the client’s network being touched. In the narrow sense, Coinbase can say it was not breached. Its customers’ data was still exposed.
No technical cause has been disclosed, and I will not guess at one. The data involved, however, is classic raw material for fraud. A confirmed link between a phone number or email address and an account on a particular crypto exchange lets criminals write convincing lures. Cyber Security News points out that contact data alone does not unlock a wallet, but it does make a fake “account restricted” or “urgent security check” message far more believable.
Why it matters for UK organisations
Coinbase serves customers in the UK, and nothing it has said so far rules UK users in or out. Anyone in Britain who holds a Coinbase account should assume they may be targeted, whether or not they receive a notification. Leaked contact data tied to a named exchange makes the crypto impersonation scams already common in Britain more effective, and crypto transfers are generally impossible to reverse.
The wider lesson goes well beyond crypto. Analytics, customer engagement and marketing platforms sit inside the apps and websites of UK banks, retailers, utilities and public bodies. Under UK GDPR, the organisation that decides why customer data goes to such a vendor is the controller and stays accountable for it, even when the vendor is the one breached. If the incident creates a risk to individuals, the controller has to assess it and, where the threshold is met, report it to the ICO within 72 hours of becoming aware. A supplier’s silence, as with Amplitude’s lack of comment here, does not pause that clock.
Third-party risk programmes often focus on suppliers with network access and pay less attention to SaaS tools that receive data quietly through an SDK.
Expert view
In my experience, when we map data flows during an assessment, analytics and marketing tags are the part of the estate that surprises clients most. Teams add an SDK to measure a funnel, someone decides it would help to attach the user’s email so marketing can segment, and two years later nobody remembers the vendor holds a copy of the customer base. It rarely appears in the record of processing, and the keys used to push data in are often long-lived.
I would also be careful with the “we were not breached” framing. It may be accurate for the infrastructure, and it rightly reassures people about funds. But regulators and customers care about where the data went, not whose server it was on. The most useful thing Coinbase and Amplitude can do now is publish specifics: which fields, how many people, which time window and what attack vector.
Finally, the phishing that follows a leak like this usually does more damage than the leak itself, and it tends to start within days.
What to do now
- If you use Amplitude, ask your account team directly whether your tenant was affected, which projects and fields were involved, and the time window. Record the date you first became aware, because it may start your ICO reporting clock.
- Audit what you send to analytics and marketing SDKs. Find every place an email address, phone number or other direct identifier is passed to a third-party platform. Replace these with pseudonymous internal IDs wherever possible.
- Rotate API and project keys for analytics and engagement platforms, and remove any that are embedded in places they do not need to be. This sits under the Cyber Essentials secure configuration and user access control themes.
- Review vendor admin access. Enforce single sign-on and multi-factor authentication on every SaaS console that holds customer data, and remove dormant accounts.
- Update your data map and supplier register so analytics vendors are listed as processors, with breach notification timescales in contracts.
- Brief customer-facing teams and customers. Remind people that genuine support staff will never ask for passwords, one-time codes, recovery phrases or remote access, and that they should go to the official app or website rather than following links.
- Individual Coinbase users should move from SMS codes to an authenticator app or passkey where available, and treat any unexpected call or message about their account as suspect.
Bottom line
Coinbase’s core platform may be intact, but customers’ contact details still leaked through a supplier most of them have never heard of. Until Amplitude explains what happened, every organisation sending identifiable data to an analytics platform should check what it shares, who can reach it and how quickly it would find out.
Sources
- CoinDesk: Coinbase says user funds are safe after third-party vendor exposes customer contact info
- Unchained: Coinbase ties customer contact data exposure to vendor Amplitude, says it was not breached
- Cyber Security News: Coinbase customer data exposed via analytics vendor Amplitude security incident
- FinanceFeeds: Coinbase denies direct data breach, confirms customer information exposed through analytics vendor
- Cointelegraph: Coinbase denies systems breach, says vendor exposed customer data
