Chainalysis says breach exposed password hashes and live tokens for users
In brief
- Chainalysis said Wednesday a cyberattack had a wider impact than it first disclosed.
- Names, usernames, password hashes and live tokens were exposed, an updated notice says.
- An on-path attack exposed some customers' passwords, a separate update said.
- Chainalysis is locking affected accounts and requiring password resets.
- Chainalysis said it has no evidence investigation or attribution data was touched.
From non-sensitive data to password hashes
Chainalysis first said on Oct. 30 that the intrusion exposed user IDs, names and email addresses. At the time, the company said it had found no evidence that attackers accessed authentication credentials or session tokens.
That's no longer the full picture.
In an update to its incident notice, Chainalysis said it discovered on Monday that customer information had been exposed to a malicious actor, including names, usernames, password hashes and live tokens. The statement referred to all Chainalysis users.
"On Monday, we discovered certain customer information including names, usernames, password hashes and live tokens for all Chainalysis users were exposed to a malicious actor," Chainalysis said in the update.
There's a caveat here. Chainalysis didn't say whether every type of information was exposed for every user, and it declined to give Cointelegraph any information beyond its published disclosure.
A separate on-path attack
Another Wednesday update said an "on-path attack" exposed some customers' passwords. The company said it had contained and fixed that attack vector (it's also locking affected accounts and requiring password resets).
So two updates landed on the same day. One widened the list of exposed data across the user base, while the other pointed to passwords exposed through a specific attack path.
What Chainalysis says wasn't touched
Chainalysis said it still has no evidence that attackers accessed investigation data or manipulated its attribution data, according to Cointelegraph's report.
That's the same kind of assurance the company gave on Oct. 30 about credentials and session tokens. Wednesday's update now puts password hashes and live tokens on the list of exposed data, after the firm had first described the attack as involving only non-sensitive customer information.
Users with Chainalysis accounts can expect a lock notice or a forced password reset if their account was affected, since the company said that's the step it's taking.
Frequently asked questions
What customer data did Chainalysis say was exposed in the breach?
In an updated incident notice, Chainalysis said it discovered on Monday that names, usernames, password hashes and live tokens were exposed to a malicious actor. It didn't say whether every type of information was exposed for every user, and it declined to give Cointelegraph more detail.
How did Chainalysis first describe the attack?
On Oct. 30, Chainalysis said the intrusion exposed user IDs, names and email addresses. It said at the time that it had found no evidence attackers accessed authentication credentials or session tokens.
What is Chainalysis doing about the on-path attack?
Chainalysis said a separate on-path attack exposed some customers' passwords. The company said it had contained and fixed that attack vector, and that it's locking affected accounts and requiring password resets.
