HQ/EMEAFind out how we can help your business
CoinFlip, the Bitcoin ATM operator, discovered an unauthorised breach of its systems a couple of months ago.
Based on reports, this entity immediately notified the Vermont Government of the data breach and shared this information with its customers last month. However, the breach remained under the radar in the media since no cybercriminal group claimed responsibility, sparking suspicions of a potential ransomware attempt to extort the company.
This speculation stems from the timeframe of the breach, which went undetected from August until the company notified its customers in September.
CoinFlip is one of the most widely used crypto ATMs in the United States since it is an affiliate of Bitcoin. In addition, it offers cryptocurrency trading with cash and runs the Ollive financial services app across nearly 50 states.
The CoinFlip data breach occurred after it suffered unauthorised access.
According to the data breach notification disseminated by CoinFlip, an unauthorised third-party access infiltrated its systems on August 7, 2023. Additionally, the company believes that the breach occurred due to social engineering tactics used by the attackers.
CoinFlip’s notice specified the data accessed by the hackers. One of its heads confirmed that they spotted the social engineering attack on CoinFlip on August 8, 2023, a day later. This detail indicates that the unidentified cybercriminals responsible for the social engineering attack had approximately one day of access to CoinFlip’s systems. Hence, the security team immediately eradicated the hackers from their systems, but they had enough time to harvest essential data.
However, separate research suspected that cybercriminals managed to obtain personal data stored in specific systems during this time. Further research also claimed that the attackers may have affected the data of more than 36,000 individuals.
Currently, the confirmed information that the threat actors harvested are full names and dates of birth. On the other hand, the investigation still clarifies details, such as whether a driver’s license, state-issued identification card, or passport number are included in the threat actors’ hack.
The investigation into the cyberattack concluded last month, but the data exposed during the CoinFlip social engineering attack remains uncertain. Therefore, cryptocurrency owners should be vigilant as the threat actors could use the stolen data to execute other malicious campaigns.
