Mailchimp says it was hacked — again

guest · Jan 22, 2023

By Zack Whittaker @zackwhittaker - January 18, 2023

Email marketing and newsletter giant Mailchimp says it was hacked and that dozens of customers’ data was exposed. It’s the second time the company was hacked in the past six months. Worse, this breach appears to be almost identical to a previous incident.
Click to expand...

The Intuit-owned company said in an unattributed blog post that its security team detected an intruder on January 11 accessing one of its internal tools used by Mailchimp customer support and account administration, though the company did not say for how long the intruder was in its systems, if known. Mailchimp said the hacker targeted its employees and contractors with a social engineering attack, in which someone uses manipulation techniques by phone, email or text to gain private information, like passwords.

The hacker then used those compromised employee passwords to gain access to data on 133 Mailchimp accounts, which the company notified of the intrusion.
Click to expand...

One of those targeted accounts belongs to e-commerce giant WooCommerce. In a note to customers, WooCommerce said it was notified by Mailchimp a day later that the breach may have exposed the names, store web addresses and email addresses of its customers, though it said no customer passwords or other sensitive data was taken.
Click to expand...

It’s not immediately clear who, if anyone, is responsible for cybersecurity at Mailchimp following the departure of its chief information security officer Siobhan Smyth shortly after the August breach.

When reached by email, Intuit spokesperson Derrick Plummer declined to answer TechCrunch’s questions, or say who was presently responsible for security at Mailchimp.
Click to expand...

guest · Jan 23, 2023

FanDuels warns of data breach after customer info stolen in vendor hack
By Lawrence Abrams @LawrenceAbrams - January 22, 2023

The FanDuel sportsbook and betting site is warning customers that their names and email addresses were exposed in a January 2023 MailChimp security breach, urging users to remain vigilant against phishing emails.
Click to expand...

On January 13th, MailChimp confirmed they suffered a breach after hackers stole an employee's credentials using a social engineering attack.
Using these credentials, the threat actors accessed an internal MailChimp customer support and administration tool to steal the "audience data" for 133 customers.

This audience data is different for each MailChimp customer but commonly contains the email addresses and names of customers, or potential customers, that are used to send marketing emails.
Click to expand...

Last Thursday, FanDuel emailed customers to warn them that the threat actors acquired their names and email addresses during the MailChimp breach.

"Recently, we were informed by a third-party technology vendor that sends transactional emails on behalf of its clients like FanDuel that they had experienced a security breach within their system that impacted several of their clients," reads a FanDuel 'Notice of Third-Party Vendor Security Incident' seen by BleepingComputer.
FanDuel also stressed that this was not a breach of their systems or FanDuel user accounts and that the hackers did not acquire "passwords, financial account information, or other personal information" during the breach.
Click to expand...

"Remain vigilant"
FanDuel urges customers to "remain vigilant" against phishing attacks and attempted account takeovers after their data was exposed in this recent breach.

"Remain vigilant against email "phishing" attempts claiming an issue with your FanDuel account that requires providing personal or private information to resolve the problem," warns the FanDuel security incident email.
"FanDuel will never email customers directly and request personal information to resolve an issue."
Click to expand...

guest · Jan 23, 2023

Companies Impacted by Recent Mailchimp Breach Start Notifying Customers
By Eduard Kovacs @EduardKovacs - January 23, 2023

Companies affected by the recent Mailchimp data breach have started notifying customers. The list includes WooCommerce, FanDuel, Yuga Labs and the Solana Foundation.
Click to expand...

According to Mailchimp, the hacker targeted employees and contractors in a social engineering attack and used compromised employee credentials to gain access to some Mailchimp accounts.

“Based on our investigation to date, this targeted incident has been limited to 133 Mailchimp accounts. There is no evidence that this compromise affected Intuit systems or customer data beyond these Mailchimp accounts,” the company said in a notice published on its website.
In response to the breach, Mailchimp suspended access for the targeted accounts and notified impacted customers.
Click to expand...

WooCommerce told customers that some of the information they shared may have been exposed, including name, URL, address, and email address. Passwords, payment data or other sensitive information was not exposed, nor was any store using WooCommerce.

Online gambling service FanDuel has also informed customers that their name and email address may have been compromised. The FanDuel notification says the incident involved a third-party technology vendor and does not name Mailchimp.
Click to expand...

The Solana Foundation, the nonprofit behind the Solana blockchain and cryptocurrency network, was also impacted and it did name Mailchimp in its notification to customers.

Yuga Labs, a blockchain technology company that develops NFTs and digital collectibles, best known for the Bored Ape Yacht Club NFT collection, also confirmed being hit by the Mailchimp breach. Yuga Labs said it only used the service for limited purposes and there was no evidence that data from its Mailchimp account was exported.
Click to expand...

Log in or Sign up

Mailchimp says it was hacked — again

guest Guest

guest Guest

guest Guest

Log in or Sign up

Mailchimp says it was hacked — again

guest Guest

guest Guest

guest Guest

Useful Searches