TaskUs Vendor Cyber Rating & Cyber Score

Incident Types: The types of cybersecurity incidents that have occurred include Breach.

Total Financial Loss: The total financial loss from these incidents is estimated to be $400 million.

Detection and Response: The company detects and responds to cybersecurity incidents through an incident response plan activated with yes (coinbase), and law enforcement notified with yes (coinbase notified regulators), and containment measures with termination of bribed employees (~300 in january 2025), containment measures with ended partnership with taskus, and remediation measures with tightened vendor and insider controls (coinbase), remediation measures with $20 million reward for information leading to arrests, and recovery measures with reimbursement of affected coinbase customers, and communication strategy with public disclosure in may 2025 (coinbase), communication strategy with no prior disclosure by taskus (alleged concealment), and incident response plan activated with yes, and containment measures with contractor terminated, affected users notified, and remediation measures with identity theft protection services provided to affected users, and communication strategy with public disclosure, regulatory notifications..

Common Attack Types: The most common types of attacks the company has faced is Breach.

Identification of Attack Vectors: The company identifies the attack vectors used in incidents through Bribed TaskUs Employees (India Operations) and Contractor access.

Average Financial Loss: The average financial loss per incident is $200.00 million.

Commonly Compromised Data Types: The types of data most commonly compromised in incidents are Customer Account Information, Sensitive Account Details (Photographed), , Personal Identifiable Information (Pii), Kyc Information, Transaction Histories, Wallet Balances and .

Incident Response Plan: The company's incident response plan is described as Yes (Coinbase), Yes.

Prevention of Data Exfiltration: The company takes the following measures to prevent data exfiltration: Tightened Vendor and Insider Controls (Coinbase), $20 Million Reward for Information Leading to Arrests, , Identity theft protection services provided to affected users.

Handling of PII Incidents: The company handles incidents involving personally identifiable information (PII) through by termination of bribed employees (~300 in january 2025), ended partnership with taskus, , contractor terminated and affected users notified.

Data Recovery from Ransomware: The company recovers data encrypted by ransomware through Reimbursement of Affected Coinbase Customers, .

Ensuring Regulatory Compliance: The company ensures compliance with regulatory requirements through Class Action Lawsuit (Southern District of New York), Potential Regulatory Investigations, .

Key Lessons Learned: The key lessons learned from past incidents are Insider threats pose significant risks, especially in third-party contractor relationships. Enhanced monitoring and access controls are critical for mitigating such breaches.

Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: Decrypt, and Source: Reuters, and Source: Amended Class Action Complaint (Southern District of New York)Date Accessed: 2025 (Filed on Tuesday, exact date unspecified), and Source: Coinbase Disclosure, and Source: Shiny Lapsus Hunters (SLH) Telegram Post.

Communication of Investigation Status: The company communicates the status of incident investigations to stakeholders through Public Disclosure In May 2025 (Coinbase), No Prior Disclosure By Taskus (Alleged Concealment), Public disclosure and regulatory notifications.

Advisories Provided: The company provides the following advisories to stakeholders and customers following an incident: were Coinbase Notified Affected Users, Reimbursement Provided, and Affected users notified and provided with identity theft protection services.

Corrective Actions Taken: The company has taken the following corrective actions based on post-incident analysis: Coinbase: Ended Taskus Partnership, Tightened Controls, $20M Reward For Arrests, Taskus: Terminated ~300 Employees (Allegedly Involved), , Contractor terminated, affected users notified, identity theft protection services provided, regulatory notifications completed.

Ransom Payment History: The company has Paid ransoms in the past.

Last Attacking Group: The attacking group in the last incident were an Organized Criminal GroupBribed TaskUs Employees (India Operations) and Shiny Lapsus Hunters (SLH).

Most Recent Incident Detected: The most recent incident detected was on 2024-12.

Most Recent Incident Publicly Disclosed: The most recent incident publicly disclosed was on 2025-05.

Highest Financial Loss: The highest financial loss from an incident was $400 million (estimated total loss).

Most Significant Data Compromised: The most significant data compromised in an incident were Coinbase Customer Account Information, Personally Identifiable Information (PII), , Personal data (names, email addresses, phone numbers, KYC information, wallet balances and transaction histories).

Containment Measures in Most Recent Incident: The containment measures taken in the most recent incident were Termination of Bribed Employees (~300 in January 2025)Ended Partnership with TaskUs, Contractor terminated and affected users notified.

Most Sensitive Data Compromised: The most sensitive data compromised in a breach were Coinbase Customer Account Information, Personal data (names, email addresses, phone numbers, KYC information, wallet balances, transaction histories) and Personally Identifiable Information (PII).

Number of Records Exposed in Most Significant Breach: The number of records exposed in the most significant breach was 30.0.

Highest Ransom Paid: The highest ransom paid in a ransomware incident was No (Coinbase refused to pay criminals).

Most Significant Legal Action: The most significant legal action taken for a regulatory violation was Class Action Lawsuit (Southern District of New York), Potential Regulatory Investigations, .

Most Significant Lesson Learned: The most significant lesson learned from past incidents was Insider threats pose significant risks, especially in third-party contractor relationships. Enhanced monitoring and access controls are critical for mitigating such breaches.

Most Significant Recommendation Implemented: The most significant recommendation implemented to improve cybersecurity was Provide regular security awareness training for employees and contractors, Establish clear protocols for reporting and responding to insider threats, Enhance monitoring of internal systems for unauthorized access and Implement stricter access controls for contractors and third-party vendors.

Most Recent Source: The most recent source of information about an incident are Shiny Lapsus Hunters (SLH) Telegram Post, Amended Class Action Complaint (Southern District of New York), Reuters, Coinbase Disclosure and Decrypt.

Current Status of Most Recent Investigation: The current status of the most recent investigation is Ongoing (Class Action Lawsuit, Potential Regulatory Probes).

Most Recent Customer Advisory: The most recent customer advisory issued were an Coinbase Notified Affected UsersReimbursement Provided and Affected users notified and provided with identity theft protection services.

Most Recent Entry Point: The most recent entry point used by an initial access broker were an Bribed TaskUs Employees (India Operations) and Contractor access.

Most Recent Reconnaissance Period: The most recent reconnaissance period for an incident was Late 2024 to Early 2025.

Most Significant Root Cause: The most significant root cause identified in post-incident analysis was Inadequate Vendor Security Oversight (Coinbase)Insider Threat Vulnerabilities (TaskUs)Failure in HR and Compliance Monitoring (TaskUs)Concealment of Breach Scope (TaskUs), Improper access by a contractor, lack of sufficient monitoring for insider threats.

Most Significant Corrective Action: The most significant corrective action taken based on post-incident analysis was Coinbase: Ended TaskUs Partnership, Tightened Controls, $20M Reward for ArrestsTaskUs: Terminated ~300 Employees (Allegedly Involved), Contractor terminated, affected users notified, identity theft protection services provided, regulatory notifications completed.