Stock trading platform Robinhood has disclosed a data breach after their systems were hacked and a threat actor gained access to the personal information of approximately 7 million customers.
The attack occurred on November 3rd after a threat actor called a customer support employee and used social engineering to obtain access to customer support systems.
After accessing the support systems, the threat actor was able to access customer information, including full names, email addresses, and for a limited number of people, data of birth, and zip codes.
“At this time, we understand that the unauthorized party obtained a list of email addresses for approximately five million people, and full names for a different group of approximately two million people,” disclosed a blog post published today about the security incident.
“We also believe that for a more limited number of people—approximately 310 in total—additional personal information, including name, date of birth, and zip code, was exposed, with a subset of approximately 10 customers having more extensive account details revealed.”
In summary, the data breach exposed:
- Email addresses for 5 million customers.
- Full names for 2 million.
- Name, date of birth, and zip code for 300 people.
- More extensive account information for 10 people.
The company states that they do not believe any Social Security numbers, bank account numbers, or debit card numbers were exposed in the attack.
After learning of the attack and securing their systems, RobinHood also received an extortion demand. While Robinhood has not provided any details regarding the extortion demand, it was likely a threat that the stolen data would be leaked if a Bitcoin ransom was not paid.
RobinHood says they continue to investigate the incident with the help of Mandiant, a well-known cybersecurity firm commonly used to perform incident response after attacks.
“As a Safety First company, we owe it to our customers to be transparent and act with integrity,” said Robinhood Chief Security Officer Caleb Sima. “Following a diligent review, putting the entire Robinhood community on notice of this incident now is the right thing to do.”
In 2019, Robinhood recommended users reset all of their passwords after it was discovered they were stored in their system in human readable format, otherwise known as clear text.
While Robinhood did not detect any unauthorized access to these passwords, it could have allowed employees to see customers’ passwords.
What should Robinhood customers do?
If you are affected by this data breach or are simply concerned about the safety of your account, Robinhood suggests you take the following steps:
- Be on the lookout for phishing emails designed to steal your login credentials. Instead, check for messages in the Robinhood app after logging into your account.
- If you need help, request a phone call from within the app at Account > Help > Contact Us. Robinhood users should never call other numbers you find in emails or the Internet.
- Only interact with the authorized Robinhood social apps. You can find these social accounts within the app at Help Center > General Questions > Robinhood Social Media.
- Report suspected phishing scams to reportphishing@robinhood.com
- Enable 2-factor authentication for Robinhood accounts within the app at Accounts > Security and Privacy > Two-Factor Authentication.
With this latest incident, passwords were not exposed, as the threat actor had access to internal systems, it would not hurt to change your password to be extra cautious.
BleepingComputer has reached out to RobinHood and will update the story if more details become available.
This is a developing story.
Source: www.bleepingcomputer.com