WORLDTECHChainalysis breach widened to password hashes and live session tokens
Blockchain analytics firm Chainalysis has widened its disclosure of a cyberattack, saying password hashes and live tokens were exposed after it had first described only non-sensitive customer information as accessed. The company, according to a Cointelegraph report, has not said how many users were affected by each type of exposure.
Scope of the exposure revised
Chainalysis said on Wednesday that the attack had a larger impact than it had first described. The company had earlier characterised the intrusion as involving only non-sensitive customer information, but it now says password hashes and live tokens were also exposed.
An earlier disclosure said the intrusion exposed user IDs, names and email addresses, and that no evidence had been found that attackers accessed authentication credentials or session tokens. The later statements have narrowed that position.
Passwords and accounts affected
A separate update issued the same day stated that an on-path attack exposed some customers' passwords. Chainalysis said it had contained and remediated that attack vector.
As a precaution, the company is locking affected accounts and requiring password resets.
What remains unconfirmed
Chainalysis did not disclose whether each type of information was exposed for every user. It also declined to give Cointelegraph any detail beyond its published disclosure.
The company said it still has no evidence that attackers accessed investigation data or manipulated its attribution data, despite the wider exposure.
Open questions
- How many users had password hashes or live tokens exposed?
- Was every affected user's information exposed in the same way?