Robinhood became a victim of cyberattack

The popular trading platform Robinhood has fallen victim to a massive hacker attack. Cyber criminals are said to have gained access to personal data of up to 7 million customers of the platform. Contact data in particular is said to have been affected. The hackers gained access through a simple customer support scam.

No sensitive personal data affected

On the part of the trading platform, a press release was already issued on November 3. As part of the public statement, Robinhood spoke of an “unauthorized third party” obtaining customer data. In the course of this, however, the company also reassured its customers at the same time. There was no theft of highly sensitive data such as account numbers or social security numbers. Nevertheless, the number of stolen data is alarming. Robinhood reports that a total of almost 7 million users were affected. Victims of the attack, however, the company immediately sent an email to let them know.

Access via social engineering

But how were the hackers able to gain access to customer data? The resourceful cybercriminals used the classic method of social engineering. The linchpin was a customer service employee who unceremoniously created a loophole for the attacker(s) – unintentionally, of course. On closer inspection, the whole thing does not sound like witchcraft. Robinhood commented on the scope of the data theft itself as follows:

“At this point, we believe the unauthorized party obtained a list of email addresses from about five million people and the full names of another group of about two million people.”

While the attackers “only” gained access to email addresses and names for a large portion of members, the data that leaked out was likely far more sensitive for a few users. In this regard, Robinhood said:

“We also believe that a limited number of individuals – about 310 in total – had additional personal data such as name, date of birth and zip code disclosed, with a subset of about 10 customers having even more extensive account data disclosed. We are in the process of notifying the affected individuals accordingly.”