What Happened
Trezor warned in a Sunday tweet that it was investigating “a potential data breach of an opt-in newsletter hosted on Mailchimp” and that users should avoid opening emails from “[email protected].”The company explained that its marketing and automation email management software Mailchimp was compromised by an insider who was targeting cryptocurrency companies. Trezor took down the phishing domain and recommended that users ensure they “are using anonymous email addresses for bitcoin-related activity.”
According to a Monday TechCrunch report, Mailchimp confirmed a data breach after hackers compromised an internal tool to access customer accounts, which goes to show that not only Trezor and its users are affected by the breach. The company’s chief information security officer Siobhan Smyth said that the company became aware of the breach on March 26, after identifying a malicious actor that was able to use a tool meant for internal company use to access customer accounts.
Attackers gained access to the systems through social engineering, meaning that instead of compromising software, they were able to mislead people involved in the company in ways that allowed them to access Mailchimp’s internal tool. The firm claims that it “acted swiftly to address the situation by terminating access for the compromised employee accounts and took steps to prevent additional employees from being affected.”
What Users Should Expect
Fortunately, those API keys have now been disabled, but cryptocurrency users should anticipate receiving phishing emails carrying malware or attempting to extract credentials such as emails, passwords, or even private keys or recovery words for wallets containing cryptocurrencies such as Bitcoin. These emails could have been potentially sent by addresses owned by companies that the users trust through Mailchimp’s APIs.Furthermore, since the APIs were deactivated, the hackers have no easy way to continue using the official email addresses of the compromised crypto and financial firms. Still, attackers have the email addresses of hundreds of users involved with those companies so phishing emails coming from different email addresses—presumably often impersonating trusted companies that users are familiar with—should be expected.
