By 
Email marketing firm MailChimp disclosed that threat actors have gained access to its internal customer support and account management tools in order to steal audience data and perform phishing attacks.
The owners of Trezor hardware cryptocurrency wallets received phishing notifications claiming that the company suffered a data breach which prompted Trezor customers to reset their hardware wallet PINs by downloading malicious software that allowed stealing the stored cryptocurrency.
Trezor later shared that MailChimp was compromised by hackers targeting the cryptocurrency industry, who conducted the phishing attack.
Later MailChimp has confirmed that the breach was more significant than just Trezor's account being accessed by threat actors. According to MailChimp, some of their employees were the victims of a social engineering attack that led to the theft of their credentials.
MailChimp CISO, Siobhan Smyth said that on March 26, their Security team became aware of a malicious actor accessing one of its internal tools used by customer-facing teams for customer support and account administration. They immediately acted to address the situation by terminating access for the compromised employee accounts and took steps to prevent additional employees from being affected.
These credentials were used to access 319 MailChimp accounts and to export "audience data," likely mailing lists, from 102 customer accounts.
In addition to viewing accounts and exporting data, the threat actors also gained access to API keys for an undisclosed number of customers, which have now been disabled and can no longer be used.
Application Programming Interface (API) keys are access tokens that allow MailChimp customers to manage their accounts and perform marketing campaigns directly from their own websites or platforms.
Using these compromised API keys it is possible for a hacker to create custom email campaigns, such as phishing campaigns, and send them to mailing lists without accessing MailChimp's customer portal.
All of the compromised account holders have been notified and the threat actors accessed customers in the cryptocurrency and finance sectors.
MailChimp recommends that all customers must enable two-factor authentication on their accounts.
Image Credits : TechnologyAdvice
