[MART] - Daily Diary #392 - Robinhood Stock Trading Platform Breached

[CTAS-MAT]

Hello,

I hope everyone is doing well!

Below is the entry for today.

11/17/2021 - Diary entry #392:


Robinhood is a mobile stock trading platform with about 22 million users. On November 03, 2021, Robinhood suffered a breach when an unauthorized third party exfiltrated a huge amount of data (about 7 million), such as customers' names, email addresses, dates of birth, zip codes, and additional personal information.


This breach was leveraged via social engineering to trick an employee into giving access to customer support systems. Two days after the disclose of the attack, a threat actor named "pompompurin" posted on a hacking forum selling the stolen data for at least five figures ($10,000 or higher). "Pompompurin" is the same actor who took credit for sending out thousands of emails last week from an official FBI email address. The threat actor declared that additional information (ID cards downloaded from SendSafely) were also stolen, despite the allegations of Robinhood, that minimized the impact of the attack.


Although passwords were not exfiltrated, the stolen sensitive data on wrong hands is very valuable, as it's enough to perform effective social engineering attacks like spear-phishing campaigns. This is especially dangerous when you use stolen data from a financial platform like Robinhood.

Kind Regards,

[https://d3aafpijpsak2t.cloudfront.net/images/Signature/logo@2x.png]<https://www.appgate.com/>

[https://d3aafpijpsak2t.cloudfront.net/images/Signature/likedin@2x.png]<https://www.linkedin.com/company/appgate-security/>     [https://d3aafpijpsak2t.cloudfront.net/images/Signature/twitter@2x.png] <https://twitter.com/AppgateSecurity>   [https://d3aafpijpsak2t.cloudfront.net/images/Signature/youtube@2x.png] <https://www.youtube.com/channel/UC-8GvxcZbm-R3EJNl8jYjiQ>



Felipe Tarijon de Almeida
Malware Analyst
Appgate

E: felipe.tarijon at appgate.com<mailto:felipe.tarijon at appgate.com>
O: +55 11 97467 9549

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.immunityinc.com/pipermail/mart/attachments/20211117/f23d104f/attachment.htm>