# Amplitude analytics security incident exposes Coinbase customer contact data · pwn.watch > Coinbase said on Oct 28 2026 that it was not breached itself, but that its product analytics vendor Amplitude had a security incident which exposed contact data for a small subset of Coinbase customers, as well as data belonging to other Amplitude customers. Coinbase says it found no evidence of unauthorized access to its own systems, customer funds are not affected, and it will notify affected customers and regulators as required. The claim of more than 70,000 affected users circulating on X has not been confirmed by Coinbase or Amplitude. Page: https://pwn.watch/i/amplitude-vendor-incident-coinbase-contact-data-oct-2026 · generated 2026-10-28T05:44:34.569Z ## Status - Severity: medium · status: live · patch: partial - Product: Amplitude product analytics (customer data of Coinbase and other Amplitude clients) - Started: 2026-10-28 ## Follow this incident - RSS (one item per update): https://pwn.watch/i/amplitude-vendor-incident-coinbase-contact-data-oct-2026/feed.xml - JSON Feed: https://pwn.watch/i/amplitude-vendor-incident-coinbase-contact-data-oct-2026/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/amplitude-vendor-incident-coinbase-contact-data-oct-2026.json - This file: https://pwn.watch/i/amplitude-vendor-incident-coinbase-contact-data-oct-2026/llms.txt ## Updates (newest first) - 2026-10-28: Coinbase says it was not breached: its analytics vendor Amplitude had a security incident that exposed contact data for a small subset of Coinbase customers, along with data of other Amplitude customers. Coinbase found no unauthorized access to its own systems and says funds are not affected. (https://x.com/CoinbaseSupport/status/2115274731310002356) - 2026-10-27: Posts on X claim Coinbase suffered a data breach exposing contact details of more than 70,000 users. (https://www.chaincatcher.com/en/article/2299485) ## Fix brief # Security brief: Amplitude analytics security incident exposes Coinbase customer contact data Source: https://pwn.watch/i/amplitude-vendor-incident-coinbase-contact-data-oct-2026 · status: live · severity: medium · updated Oct 28, 2026, 05:43 UTC ## Patch status **PARTIALLY PATCHED: some fixes exist, but not every affected branch/product is covered. Check carefully and apply mitigations where no fix exists.** ## What it is Coinbase said on Oct 28 2026 that it was not breached itself, but that its product analytics vendor Amplitude had a security incident which exposed contact data for a small subset of Coinbase customers, as well as data belonging to other Amplitude customers. Coinbase says it found no evidence of unauthorized access to its own systems, customer funds are not affected, and it will notify affected customers and regulators as required. The claim of more than 70,000 affected users circulating on X has not been confirmed by Coinbase or Amplitude. Severity detail: Contact data only according to Coinbase, but crypto exchange customer lists are prime material for targeted phishing and impersonation scams; other Amplitude customers are affected too - Product: Amplitude product analytics (customer data of Coinbase and other Amplitude clients) ## Affected versions - Not specified in the data. Check the advisories below. ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix No fixed version is listed. Follow the vendor advisory below. ## Mitigations The data marks this as partial. Until every affected component is fixed, apply the vendor mitigations from the advisories below (restrict network exposure of the affected service, disable the vulnerable feature if the advisory allows). ## Secrets to rotate This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs. ## Specific notes If you have a Coinbase account, expect phishing emails, texts and calls that quote your name, email or phone number. Coinbase never asks you to move funds to a new wallet or share a seed phrase or 2FA code. If your company sends user data to Amplitude, review which personal fields you send, rotate Amplitude API keys and secret keys, check project member access and audit logs, and watch for a notice from Amplitude. ## Latest updates - Oct 28, 2026: Coinbase says it was not breached: its analytics vendor Amplitude had a security incident that exposed contact data for a small subset of Coinbase customers, along with data of other Amplitude customers. Coinbase found no unauthorized access to its own systems and says funds are not affected. - Oct 27, 2026: Posts on X claim Coinbase suffered a data breach exposing contact details of more than 70,000 users. ## Advisories - [Coinbase Support on X: Amplitude, an analytics vendor, experienced a security incident](https://x.com/CoinbaseSupport/status/2115274731310002356) (Coinbase) ## Write-ups & news - [Coinbase denied its data breach, stating it was an Amplitude security incident](https://www.chaincatcher.com/en/article/2299485) - [Clarification Regarding Recent Data Security Notice (SpotAngels data exported from Amplitude, Sept 2026)](https://www.spotangels.com/blog/clarification-regarding-recent-data-security-notice/) ## Caveats Amplitude has not published its own statement yet, and the number of affected Coinbase customers and other Amplitude clients is not known. Separately, SpotAngels disclosed on Oct 8 2026 that stolen SpotAngels account credentials were used Sept 5 to 13 to export its data stored in Amplitude, and said Amplitude's platform was not compromised in that case; whether that is related is unknown. --- Machine-readable: https://pwn.watch/i/amplitude-vendor-incident-coinbase-contact-data-oct-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.