Coinbase said Indian police have arrested a former customer support employee in connection with a large-scale data breach that affected nearly 70,000 users.

Coinbase CEO Brian Armstrong confirmed that a former customer service employee based in Hyderabad, India, was arrested for involvement in the data leak disclosed in May. The incident dates back to December 2024, when cybercriminals bribed overseas support staff to obtain user data, including names, addresses, phone numbers, and identification documents.

According to filings Coinbase submitted to the Maine Attorney General’s Office in the United States, a total of 69,461 users were affected. The hackers demanded a $20 million ransom, which Coinbase refused to pay. Instead, the company offered a reward of the same amount for information leading to the arrest of those responsible.

An investigation by Fortune revealed that several employees of TaskUs—a Texas-based outsourcing firm operating in India—were drawn into an organized criminal scheme that did not target Coinbase alone. In its Q2 financial report, Coinbase recorded $307 million in costs related to the breach, including remediation efforts and customer compensation.

The company is also facing a shareholder class-action lawsuit, alleging delays in disclosing information about the security incident.