Bitcoin Depot Discloses Data Breach Impacting 27K Users After Law Enforcement Delay

Bitcoin Depot has informed nearly 27,000 customers about a data breach that occurred over a year ago, following directions from federal authorities to withhold disclosure due to an active investigation. 

The crypto ATM operator filed notice with the attorneys general of Maine and Massachusetts on Monday, revealing that an “external system breach” on June 23, 2024, exposed user data belonging to 26,732 customers.

A spokesperson for Bitcoin Depot stated that law enforcement had advised the company to delay notifying customers while an investigation into the third party responsible was underway. On June 13, federal authorities informed Bitcoin Depot that the investigation was complete, clearing the company to proceed with disclosure.

Bitcoin Depot User Data Exposed

The breach involved sensitive customer data, including names, phone numbers, driver’s license numbers, and potentially addresses, birth dates, and emails, the company disclosed in its notice. Despite the exposure of this personal information, Bitcoin Depot emphasized that there is “no evidence of customer information being misused.”

“Bitcoin Depot remains committed to protecting customer data and privacy,” the spokesperson said. Customers have been advised to monitor their credit reports, report suspicious activity, and consider placing fraud alerts or security freezes with credit agencies to reduce the risk of identity theft or fraudulent activities.

The company explained that it detected unusual activity within its network in June 2024 and immediately launched an investigation with a leading cybersecurity firm. By July 18, 2024, the investigation confirmed that an unauthorized party had accessed files containing customer information. 

Bitcoin Depot has since enhanced its security measures, implemented stricter monitoring, and increased staff awareness around data protection.

Broader Industry Faces Persistent Threats

The crypto industry remains a lucrative target for hackers, with attacks on crypto exchanges and service providers becoming frequent. Earlier this year, Coinbase was targeted by hackers who bribed third-party contractors to access customer data, later rejecting a $20 million ransom demand when attackers leaked the data.

In December, another crypto ATM operator, Byte Federal, reported a breach potentially affecting 58,000 customers after attackers exploited a third-party software vulnerability. Although no customer funds were reported stolen in these incidents, they highlight the persistent security challenges within the crypto and fintech sectors.

Bitcoin Depot stated it is continuing to cooperate with law enforcement to address the incident and prevent future occurrences, underscoring the importance of robust cybersecurity practices in safeguarding user data in the evolving crypto landscape.