One year ago this month, Coinbase filed an 8-K disclosing that bribed contractors at a TaskUs service center in Indore had been exfiltrating customer data for months. The coverage focused on the $20 million ransom Coinbase rejected and converted into a $20 million bounty for information leading to the attackers' arrest. The detail that procurement teams have still not priced into their vendor questionnaires is the one named in the criminal docket: a single TaskUs agent, Ashita Mishra, photographed up to 200 customer records a day with her phone and sold each one for $200, at a salary level that made the math obvious before the breach ever began.
The standard third-party-risk questionnaires (SIG, CAIQ, HECVAT) do not have a row for this. They ask whether your BPO holds a SOC 2 Type II; they do not ask which named individuals at which subcontractor location hold bulk-export entitlement, nor what segregation exists between bulk-export tooling and per-ticket customer lookup. The Coinbase timeline is the cleanest available argument for adding that row, and it sits one position down the sequence of missing procurement rows I named in Lovable's 76-day disclosure post: privileged-identity, data-custodian, disclosure-maturity, and now vendor-personnel.
September 2024: The Theft Begins
Class-action filings allege the exfiltration started in September 2024, with a breach date of December 26, 2024 once a discrete bulk pull was identified. The data classes Coinbase later disclosed in its 8-K include names, postal addresses, phone numbers, email addresses, last-four Social Security digits, masked bank account numbers, government-issued ID images, account balances, and transaction histories; login credentials, two-factor secrets, and private keys were not compromised. The distinction matters: this was not a credential-theft incident that platform-side controls could have caught, but an authorized-user incident in which the authorized user was holding a smartphone over a CRM screen.
The operating environment made that economically rational. TaskUs agents at the Indore service center earn approximately $500 to $700 a month according to Fortune's reporting on the location. At $200 per record and 200 records on a productive day, a single agent's daily side income exceeded their monthly base salary by a factor of more than fifty. Prosecutors allege Mishra enlisted supervisors and team leaders, which is consistent with what you would expect from an environment where the wage gradient between agent and supervisor is too narrow to deter coordinated collusion.
The architectural decision that enabled the day-over-day exfiltration was not platform compromise; it was that the per-agent entitlement included bulk lookup of customer records rather than per-ticket lookup gated to an open case. This is the same architectural class as the agentic-AI insider-threat category I covered in agentic AI and the insider threat problem: an authorized actor holding bulk access entitlements that the workflow does not require on a per-action basis.
January 2025: Coinbase Knows, the Public Does Not
Mishra was arrested in January 2025, and Coinbase learned of the breach the same month, per PYMNTS reporting. TaskUs subsequently terminated 226 staff associated with the Coinbase contract following discovery of the breach. The class-action complaint further alleges that TaskUs fired its internal HR investigation team on February 10, 2025, framing the dismissals as part of a pattern of concealment rather than a clean remediation.
This is the four-month window that procurement teams should be re-reading. Coinbase had knowledge of contractor-mediated exfiltration in January; the public 8-K did not arrive until May 14, 2025. A separate, smaller incident in December 2024 had already exposed roughly 30 customers through a leaked support-tool screenshot from a contractor, which means the Indore breach was the second contractor-access incident inside a single quarter. Two incidents in the same channel, in the same quarter, is the signal that the issue is structural rather than isolated, and it is the same contractor-portal vector class that surfaced one level up the stack at Anthropic's Mythos model exposure through a third-party contractor portal.
The materiality question here is not whether Coinbase met its 8-K filing window (the SEC's four-business-day clock is triggered by the determination of materiality, not by initial knowledge); it is whether the procurement function at any large BPO customer has the visibility to learn that a subcontractor's HR investigation team was dismissed during an active incident. The honest answer, in the absence of contractual attestation rights, is no.
May 2025: Disclosure and the Materiality Reframe
The class-action complaint pegs the discovery date at May 11, 2025, with the 8-K filed three days later and the public bounty announcement following on May 15. The Milberg filing alleges approximately 69,461 affected users; Coinbase's own disclosure characterizes the population as less than 1% of monthly transacting users. The remediation cost estimate Coinbase reported is $180 million to $400 million, which prices a contractor-mediated breach at roughly $2,500 to $5,800 per affected record before litigation exposure.
The dwell time deserves a precise number rather than a rounded one. From the alleged September 2024 start of exfiltration to the May 11, 2025 discovery date, the gap is approximately 7.5 months; from the December 26, 2024 breach date in the class-action complaint to discovery, it is 4.5 months. Either figure exceeds the median dwell time for credential-mediated intrusions in current industry reporting. Insider-mediated exfiltration with bulk-export entitlement evades the detection telemetry tuned for credential abuse, lateral movement, and external command-and-control; there is no anomalous network signature when the exfiltration channel is a phone camera held over a monitor.
The analyst commentary on the incident is consistent on this point. Steve Cobb, CISO at SecurityScorecard, observed that outsourced staff frequently hold the same privileges as full-time employees without commensurate monitoring, and Kevin Kirkwood at Exabeam noted in the same coverage that mature insider-threat programs are uncommon at BPO subcontractor locations. The privilege model traveled with the work; the detection model did not.
What This Means Now: The Personnel-Blast-Radius DDQ Row
The Coinbase 8-K is a useful argument for adding a row to your vendor questionnaire that the SIG, CAIQ, and HECVAT do not currently include. The row is not about whether the BPO maintains certifications; it is about personnel-level attestation at subcontractor locations with bulk-export entitlement. A workable version of the row asks four questions.
First, what is the segregation between bulk-export tooling and per-ticket customer lookup, and which named roles at which physical locations hold the bulk-export entitlement? The Coinbase incident is the cleanest evidence that aggregating these into a single agent role is the failure mode worth pricing.
Second, what is the mean time to detect for insider-mediated exfiltration that does not generate anomalous network signatures (camera-based capture, screen-share leakage, printed records)? The 4.5-month dwell time in the class-action complaint is the floor your contract should treat as unacceptable rather than the ceiling.
Third, what is the quarterly attestation cadence for personnel at any subcontractor location with bulk-export entitlement, and what triggers an out-of-cycle attestation (mass termination event, HR investigation dismissal, supervisor turnover above a stated threshold)? The February 10, 2025 dismissal of TaskUs's HR investigation team is the kind of signal that arrives only through contractual reporting obligations.
Fourth, what happens to your visibility into the subcontractor when the subcontractor changes ownership? Blackstone took TaskUs private in 2024, which removed the public-company disclosure surface that procurement teams had been implicitly relying on. The procurement question that arises on every private-equity acquisition of a BPO is whether the customer's contractual reporting requirements survive the ownership transition.
This is the same procurement-architecture argument I have been making across the recent vendor-governance arc: the gap exposed by the Mercor breach (treating privileged-access vendors like staffing agencies), the gap exposed by ChipSoft's ransomware and regulator visibility (concentration risk without regulator-grade attestation), and the agentic-AI personnel categories enumerated in the Five Eyes procurement questionnaire post all converge on the same point. The vendor's security posture is not your only exposure; the vendor's personnel posture, at every physical location where bulk entitlements live, is the row your questionnaire does not yet have.
The Coinbase 8-K disclosed approximately 69,461 affected accounts and a remediation cost estimate of $180 million to $400 million. The DDQ revision that would have priced this risk in advance is one row long, and it asks about named personnel at named locations with bulk-export entitlement; the procurement teams that add that row this quarter will be the ones who do not appear in next year's 8-K as the customer that did not ask.
