Chainalysis says breach exposed password hashes and live tokens
Blockchain analytics firm Chainalysis revealed on Wednesday that password hashes and live tokens were exposed to a malicious actor during a cyberattack, following an initial disclosure that only non-sensitive customer data was accessed.
The company initially reported on October 30 that the intrusion exposed only user IDs, names and email addresses, finding no evidence that attackers accessed authentication credentials or session tokens. However, the Wednesday disclosure revealed a more significant impact.
Expanded breach details
According to Chainalysis' updated incident notice, discovered on Monday, the breach exposed certain customer information including names, usernames, password hashes and live tokens for all users. The company did not specify whether each type of information was exposed for every customer.
On Monday, we discovered certain customer information including names, usernames, password hashes and live tokens for all Chainalysis users were exposed to a malicious actor.
Attack contained
Chainalysis stated that the "on-path attack" which exposed some customers' passwords has been contained and remediated. The company is locking affected accounts and requiring password resets as a precautionary measure.
Despite the broader exposure, Chainalysis maintains it has no evidence that attackers accessed investigation data or manipulated its attribution data, which are critical for blockchain transaction analysis.
Related
