Amplitude Discloses Security Incident Affecting Coinbase Customer Contact Data
Breach Summary
Updated October 29, 2026, 5:00 AM CT. Amplitude, the product analytics company, says it detected, contained and remediated unauthorized access to a localized portion of its internal systems on September 28, 2026, and that event data belonging to less than 0.3% of customer accounts was affected. Coinbase, one of those customers, said on October 27 that a small subset of its customers' contact data was affected, among other Amplitude customers, and that its own systems and customer funds were not. Neither company has given a count, a mechanism, a start date or the names of other affected customers. This page lists what is verified and what is not. Cloudskope's analysis is in Amplitude Calls It Event Data. Coinbase Calls It Contact Data. Neither Says How Many.
What Happened
Timeline (Central Time)
- February 19, 2026. Amplitude's 10-K describes a board Cybersecurity Committee (since July 2024) and says it does not believe it has experienced any significant security breach to date.
- May 1, 2026. Amplitude acquires Statsig's customer contracts, trade name and a technology license.
- August 6, 2026. Q2 10-Q repeats the risk-factor sentence on no significant breach to date.
- September 23, 2026. Amplitude posts its ISO/IEC 27001 certificate for 2026 to 2027 in its trust center.
- September 28, 2026. Amplitude's detection date for the intrusion, per its October 28 notice. Separately, its public status page opens a Data Export incident at 4:09 PM ("No data is lost"), reports at 6:37 PM that "explicit export APIs are still blocked," and closes it at 9:33 PM. Any link between the two is unconfirmed.
- October 15, 2026. Amplitude 8-K: Statsig founder Vijaye Raji joins the board and its Cybersecurity Committee. No incident disclosed.
- October 22 and 26, 2026. Four trust-center security notices on PHP, Node.js and certificate issues. None mentions the intrusion.
- October 27, 2026, evening. An X account claims, without a source, that contact details of more than 70,000 Coinbase users were obtained. Coinbase Support then posts that it "has not had a data breach" and that Amplitude's incident "impacted a small subset of Coinbase customer contact data, among other Amplitude customers."
- October 28, 2026. Amplitude posts "Customer Update - Recent Security Incident" in its trust center. Shares were reported down over 3% in extended trading.
- October 29, 2026. Coinbase reports Q3 results after the close. Amplitude reports on November 4.
What is unknown
- When the unauthorized access began and how it was obtained.
- Whether data was copied out or only accessed.
- How many Amplitude customers and how many individuals are affected.
- Which Coinbase contact fields were exposed.
- When Amplitude notified Coinbase and its other affected customers.
- Which other customers were affected, and whether any are U.S. banks, brokerages or wealth firms.
- Whether Statsig-branded services were in scope.
- The identity of the forensics firm and of the attacker.
- Whether the September 28 export incident was part of containment.
Attack Vector Detail
Stated by the companies
- Amplitude: unauthorized access to "a localized portion of Amplitude's internal systems", unrelated to PHP2Shell (CVE-2026-109618, CVE-2026-109619) and Node.js CVE-2026-111497. No mechanism given.
- Coinbase: no evidence of unauthorized access to Coinbase systems.
Confirmed by Cloudskope's direct observation (October 29, 1:56 to 2:15 AM CT)
- Amplitude's notice is published only in its trust center (trust.amplitude.com/updates, rendered by JavaScript), dated October 28 with no time of day.
- Amplitude's status-page history (50 most recent incidents, back to April 12, 2026) shows the September 28 Data Export incident and no entry describing a security incident.
- SEC EDGAR: no Item 1.05 or other incident 8-K from Amplitude or Coinbase.
- Of 52 U.S. consumer-finance homepages that loaded, five requested Amplitude or Statsig resources (Empower, Acorns, Dave, Affirm, American Express). None has reported an incident. Coinbase's homepage made no Amplitude request.
Attackers don't break in. They sign in.
Get the 7 signs your Microsoft 365 is already compromised, and where to check each one.
The checklist by email, plus a few short follow-ups. Unsubscribe anytime. Privacy policy
Breach Pattern Timeline
February 2018
Mixpanel discloses its Autotrack feature collected password-field values since a March 2017 library change.
2024
The Snowflake campaign (UNC5537) reaches about 165 potentially exposed organizations through customer credentials at a data-warehouse vendor.
November 2025
Mixpanel detects a smishing campaign on November 8; OpenAI discloses on November 26 that API users' names, emails and device data were in an exported dataset and ends its use of Mixpanel. CoinDCX also notifies users.
September to October 2026
Amplitude detects unauthorized access on September 28 and discloses on October 28 after Coinbase's October 27 post.
Executive Lessons
- Inventory analytics vendors. Product analytics, session replay and experimentation tools sit outside most penetration tests and data-loss controls.
- Stop sending direct identifiers. Use pseudonymous IDs or keyed hashes and keep the join table in-house.
- Fix the contract clock. Vendor breach notice should be measured in hours and fit the 72-hour regulatory windows under NYDFS Part 500 and amended Regulation S-P.
- Get the vendor's detection date in writing. Your own discovery date, and your deadlines, may depend on it.
- Prepare for impersonation. Accurate contact data fuels support-scam calls and texts. Warn customers early and harden help-desk verification.
Private Equity Implications
In diligence of fintech, wealth and consumer-lending targets, ask for the web and mobile SDK inventory and a sample of events and user properties actually sent to analytics vendors. Each vendor holding customer contact data is a potential notification event for the target. For software portfolio companies selling into financial services, Amplitude's filings show the questions customers will ask: how incidents reach the board, how "significant" is defined, and how a no-breach risk factor is tested.
How Cloudskope Can Help
Cloudskope's Cyber Risk Assessment covers third-party analytics, session-replay and experimentation vendors and what your applications actually send them.
Cloudskope advises boards, deal teams and general counsel on vendor incidents that become their clients' notification events.
Frequently Asked Questions
Was Coinbase hacked?
Coinbase says its own systems were not accessed and customer funds were not affected. It says a security incident at its analytics vendor, Amplitude, affected a small subset of Coinbase customer contact data.
What did Amplitude say?
Amplitude says it detected, contained and remediated unauthorized access to a localized portion of its internal systems on September 28, 2026, affecting event data belonging to less than 0.3% of customer accounts, and that it contacted each affected customer directly.
How many people are affected?
Neither company has said. A figure of 70,000 Coinbase users circulated on X without a source and has not been confirmed.
What should Coinbase customers do?
Treat unexpected calls, texts and emails claiming to be Coinbase with suspicion. Coinbase says its staff will never ask for passwords or verification codes, request remote access, or ask customers to send crypto to an outside address.