Coinbase Global (COIN) stock fell Thursday after the company said in a regulatory filing that it had been the victim of a cyberattack.

The online cryptocurrency exchange said that it received "an email communication from an unknown threat actor claiming to have obtained information about certain Coinbase customer accounts, as well as internal Coinbase documentation"

Coinbase Global (COIN) shares fell Thursday after the company said in a regulatory filing that it had been the victim of a cyberattack.

The online cryptocurrency exchange said that it received “an email communication from an unknown threat actor claiming to have obtained information about certain Coinbase customer accounts, as well as internal Coinbase documentation” on May 11. This information was related to about 0.1% of Coinbase’s customer accounts, the company said.

The threat actor appears to have paid multiple contractors or employees working in support roles outside the U.S. to collect information from internal Coinbase systems to which they had access, according to the filing.

“The communication demanded money in exchange for not disclosing this information more broadly,” the filing said. Coinbase said that it has not paid the demand and is working with law enforcement.

Its investigation is still ongoing, but Coinbase said that it expects the incident to cost between roughly $180 million and $400 million “relating to remediation costs and voluntary customer reimbursements.” This is in addition to the $150 million to $200 million in adjusted net loss that Coinbase reported for the first quarter.

Coinbase said that no passwords or customer funds were ever accessed. However, it said that names, addresses, phone numbers, email addresses, last four digits of Social Security numbers, masked bank account numbers and Coinbase account data like “balance snapshots and transaction history” may have been compromised.

Coinbase is offering credit monitoring and identity theft protection to any customer whose Social Security number may have been affected.

Coinbase shares fell 4.9% soon after markets opened. They had surged earlier this week on news that Coinbase will join the Standard & Poor’s 500 next Monday.

The latest move in the S&P 500 comes as part of a broader reshuffle that will also see Monolithic Power Systems (MPW) join the large-cap index on Monday. Meanwhile, Boston Properties (BPI) and Columbus Nova will be exiting the S&P 500 at the close of Friday, May 26.