CoinGecko suffers data breach via third service provider

Crypto data aggregator company CoinGecko suffered a data breach via one of its third-party services. Although no CoinGecko user accounts were compromised in this incident, the hackers accessed users’ vital personal information which they used to launch a large-scale phishing attack.

23,723 users compromised in data breach

According to a security notice of June 7, CoinGecko claimed that hackers accessed an employee’s account on GetResponse, an email marketing platform, resulting in a high level of unusual activity. On June 6, the GetResponse team confirmed the attack, stating that a data compromise had occurred.

Through this hack, the threat actors transferred 1,916,596 contacts from the CoinGecko GetResponse account before proceeding to send phishing emails to 23,723 of these contacts using another GetResponse account.

For context, a phishing mail represents fraudulent mail designed to trick an unsuspecting recipient into revealing particularly sensitive or important information. In this case, this information could be particularly damaging, leading to loss of property.

However, thanks to a quick response, the malicious email activity was quickly detected and stopped by CoinGecko in collaboration with GetResponse. However, some users’ data, including personal information such as user name, email address, etc., and metadata such as account registration date and subscription, have been obtained by the hacker.

Notably, the data breach at CoinGecko occurred the same day after an alert of Tether CEO Paolo Ardoino said an established email provider commonly used by crypto companies had been compromised.

To mitigate the potential damage caused by this incident, CoinGecko has contacted all users affected by the data breach. Additionally, the crypto data company has opened an investigation into the attack in partnership with GetResponse. CoinGecko advises all users to exercise caution when opening emails from strange sources/domains. In particular, they warned against any emails claiming to offer token airdrops by CoinGecko or GeckoTerminal.

Commenting on the incident, Bobby Ong, co-founder and COO of CoinGecko, highlighted similar warnings, saying:

Unfortunately, GetResponse has confirmed that we are one of the affected accounts that suffered a breach. This is a targeted supply chain attack against our email newsletter software provider. No CoinGecko token is intended, so don’t be fooled by phishing emails.

Crypto Market Overview

According to data from CoinMarketCap, the general crypto market has taken a dive recently, losing 2.74% of its market value over the past 24 hours, falling to around $2.55 trillion. Along with this decline, Bitcoin is also down 1.92% and valued at $69,392.