Indian police arrest former CEX customer service staff, first arrest in internal data leak case

On December 29, Indian police arrested a former CEX customer support staff in Hyderabad, who is suspected of involvement in the internal data breach disclosed by CEX in May this year. This is the first known arrest in the case. The news was confirmed by CEX CEO Brian Armstrong. The incident dates back to December 2024, and investigations show that cybercriminals obtained access to internal systems by bribing overseas customer support staff, stealing sensitive information of 69,461 users, including names, addresses, phone numbers, emails, and government-issued identification documents. CEX stated that the attackers attempted to extort $20 million, which the company refused to pay, and set up a bounty program of the same amount to track down and apprehend those involved. In its Q2 financial report, CEX disclosed that the incident has resulted in $307 million in related expenses, covering user compensation, legal fees, and security upgrades. Additionally, CEX is currently facing a class-action lawsuit from shareholders, accused of failing to disclose the incident in a timely manner, thereby misleading investors. CEX stated it will continue to cooperate with international law enforcement agencies and hinted that further arrests may follow.