CoinGecko report a data breach of 2 million users due to a third-party hack

The accounts on the aggregator’s own platform are safe, the hacker did not gain access to the passwords

07.06.2024 - 15:35

378

2 min

What’s new? The team at the leading cryptocurrency market data aggregator CoinGecko has reported a leak of user data caused by a hack of the third-party email platform GetResponse. An attacker hacked into the account of one of the GetResponse employees and thus gained access to the information.

Press release

What else is known? The leak was discovered on June 5 and confirmed by GetResponse on June 6. The hacker exported 1 916 596 contacts from a CoinGecko account on the GetResponse platform and sent phishing emails to 23 723 addresses.

The incident compromised personal information including username, email address, IP address, email login location, and other metadata including account registration date and paid subscription plan.

However, CoinGecko assured that accounts on the aggregator’s own platform remain safe as the hacker did not access the passwords. The team directly notified users affected by the leak via email.

CoinGecko apologized for the incident and urged caution when opening emails due to the risk of a phishing attack. Any airdrop eligibility notifications from CoinGecko or GeckoTerminal are a scam, as the platform has not officially issued any tokens.

“We are thoroughly reviewing our security procedures and will look to enhance our security protocols in collaboration with our vendors,” the company concluded.

This is not the first time the platform has encountered fraud. In January, hackers broke into CoinGecko’s X accounts and posted fake claims about the launch of a native token. Phishing links were attached to the posts purportedly to connect a wallet and receive free coins, interaction with which could result in the loss of all assets.

In 2022, a malicious pop-up window appeared on CoinGecko and other cryptocurrency portals offering to connect a crypto wallet, which also led to a phishing site to steal assets.

Author: