Mailchimp is the latest well-known tech company to be targeted by a hack to steal sensitive customer data.

On Sunday (3 April), the company confirmed that an unidentified group of hackers had gained access to internal customer support and account management tools after a successful social engineering attack on Mailchimp employees that started late last month and saw their credentials being compromised.

These credentials were then used to access more than 319 Mailchimp accounts and retrieve data from at least 102 of them, according to Bleeping Computer.

Crypto and finance companies became the primary targets of the hack, with the stolen mailing list data being used to conduct phishing attacks on clients of crypto wallet companies such as Trezor.

Trezor

Following the hack, Trezor confirmed on Twitter that it was “investigating a potential data breach of an opt-in newsletter hosted on MailChimp” and warned users to not open any emails appearing to come from Trezor until further notice.

MailChimp have confirmed that their service has been compromised by an insider targeting crypto companies.

We have managed to take the phishing domain offline. We are trying to determine how many email addresses have been affected. 1/

— Trezor (@Trezor) April 3, 2022

Trezor also said that it would not be communicating by newsletter until the situation is resolved and that users should ensure they are using anonymous email addresses for bitcoin-related activity.

“This attack is exceptional in its sophistication and was clearly planned to a high level of detail. The phishing application is a cloned version of Trezor Suite with very realistic functionality, and also included a web version of the app,” the crypto wallet company wrote in a blog.

The phishing message claimed that Trezor had experienced “a security incident” and that users had to download the latest version of Trezor Suite and set up a new PIN for their wallets. The link then helped users download a malicious version of the software that could potentially give them access to crypto wallets.

It is not known yet if any crypto assets have been stolen as a result of the hack, but Trezor confirmed that the company’s hardware device has bot been affected and that users can continue using them after wiping it and creating a new seed.

10 things you need to know direct to your inbox every weekday. Sign up for the Daily Brief, Silicon Republic’s digest of essential sci-tech news.

The post What’s going on with the Mailchimp hack? appeared first on Silicon Republic.