I was similarly shocked that the only control plane they had to limit access to sensitive information was literally terminating everything. They don't have any kind of access control that would allow them to keep an employee in their system but limit their access. How exactly are they running a "finance company" if they don't have these basic protections.
I could see if they were an early stage startup and just haven't gotten around to it, but they are multiple thousands of employees at this point. In every start up I've worked in, implementing access controls ends up being a priority around 100 employees.
I've never used Coinbase but this revelation makes me not want to ever use them in the future.
It is only fairly recently that locking people out of the office didn't implicitly remove their access to email, memos, letters and so on.
Customers email something like “[email protected]” and that routes to a ticketing system (eg Zendesk), not to people.
And, the vast majority of employees don’t directly interact with customers either.
Well designed controls deliberately keep PII data out of general purpose systems like email, drive sharing, dev ticketing, etc
I agree that the remote move introduces new risks, but those should be minimized by the existing controls in place.
This, very few people should have access to production data. This is a shocking revelation. I’m reevaluating being a customer of theirs.