The incident occurred at Amplitude, a third-party analytics provider used by Coinbase, rather than within Coinbase's own infrastructure. This exposure involved a 'small subset' of Coinbase customers' contact information, alongside data from other Amplitude clients, but did not grant unauthorized access to Coinbase’s internal systems or customer funds.