HubSpot Hack Leads to Data Breaches at BlockFi, Swan Bitcoin, NYDIG and Circle
The companies affected assured users their crypto is safe because the customer-management tool had limited access to internal data.
Mar 21, 2022 at 4:30 a.m. UTCUpdated May 11, 2023 at 7:13 p.m. UTC
:format(webp)/cloudfront-us-east-1.images.arcpublishing.com/coindesk/273UIMCF5VDQJJ4C2VHQIT3ASU.jpg)
/arc-photo-coindesk/arc2-prod/public/LXF2COBSKBCNHNRE3WTK2BZ7GE.png)
A data breach at HubSpot, a tool used by many companies to manage marketing campaigns and on-board new users, has affected BlockFi, Swan Bitcoin, NYDIG and Circle.
However, all the companies said their operations were not affected and their treasuries were not at risk.
00:59
Running With Crypto: 5 Questions With TRM Labs' Ari Redbord
09:43
Hacks Involving North Korea Are 'Even Greater Problem': Legal Experts
02:01
Breaking Down the State of Hacking in 2024
00:59
Crypto Hack Volumes Fell by More Than 50% in 2023: TRM Labs
- HubSpot is a customer relationship management (CRM) tool used to store users’ names, phone numbers and email addresses for marketing purposes, and measure the effectiveness of marketing campaigns.
- While user information was leaked to hackers, the affected companies said passwords and other internal information were not affected. In outreach emails seen by CoinDesk, the companies said HubSpot is an external tool and hackers did not gain access to internal systems.
- HubSpot said the breach was the result of a bad actor getting access to an employee account and using it to target stakeholders in the cryptocurrency industry.
- The company said 30 clients were affected, but has not published a full list.
- Some users have reported receiving an uptick in phishing emails from the companies over the weekend, attempting to lure them into entering their passwords on a fake site.
- In 2020, BlockFi suffered a breach after an employee’s SIM card was compromised and ported over to an unauthorized user. After 2020’s attack, BlockFi hired a new chief security officer.
- Crypto venture capital firm Pantera Capital said in February that its Hubspot account had been compromised, and followed up with an email to its clients on March 19.
- At this time, a timeline of events is unknown as HubSpot has not said when its systems were compromised.
UPDATE (March 21, 11:56 UTC): Adds NYDIG, Circle to headline.
:format(webp)/s3.amazonaws.com/arc-authors/coindesk/ff7c302f-d3ab-4905-92e1-2f7f5106d13c.png)