Robinhood says no financial data, assets, or Social Security numbers were stolen
On Monday, mobile app digital exchange Robinhood posted an announcement on its blog site that it experienced a security breach last Wednesday, Nov. 3 affecting more than 7 million members. The Robinhood post states that the attack has been contained and that its investigation found that there was no exfiltration of financial data, digital assets, or Social Security numbers.
The cyberattack started when a rogue third-party manipulated a Robinhood customer support employee by phone. Using social engineering tactics, the individual obtained unauthorized access to various customer support systems and client databases. The scammer downloaded a data panel comprising email addresses for five million people, and full names of two million other people in a different data set.
“As a Safety First company, we owe it to our customers to be transparent and act with integrity,” said Robinhood Chief Security Officer Caleb Sima. “Following a diligent review, putting the entire Robinhood community on notice of this incident now is the right thing to do.”
The Robinhood information security team disclosed that once the digital threat was contained, the attackers sent a communique demanding an extortion payment. Robinhood did not confirm whether they paid the ransom, but they did contact law enforcement officials. The digital exchange company also confirmed that its investigation is continuing, and Robinhood has also engaged the services of a leading outside cybersecurity firm.