Coinone Says Contractor Attack Exposed Customer-Service Data

Coinone said an attacker accessed customer-service data on servers run by its outsourced provider Nov. 12, and the exchange reported no evidence of a direct intrusion into account or wallet systems.

Coinone received notice from MetaM that day. The provider found unusual activity after its customer-service operation stopped and confirmed that phone numbers and customer-service conversations had been accessed without authorization.

Potentially involved records vary by customer and could include names, phone numbers, email addresses, birth dates and bank account details. Other possible fields include passwords, South Korean resident registration numbers, identity-document issue dates, addresses, crypto wallet addresses and transaction IDs. Coinone has not disclosed how many customers may be affected. Customers who had never contacted its service center were not affected, the exchange said.

Coinone said its customer-service servers were separated from its core crypto infrastructure and that it had found no evidence of direct access to account, trading or wallet systems as of Nov. 15. It said account access requires an OTP or KakaoTalk verification. MetaM reported the incident to South Korea’s internet security agency on Nov. 13. Coinone said it blocked the attacker’s IP address, switched customer support to email and notified South Korean authorities.