The data of about 7 million Robinhood customers, stolen in a recent data breach, is being sold on a popular hacking forum.
Last week, Robinhood revealed that it had been the victim of a data breach after a cybercriminal managed to trick an employee into accessing its customer service systems. The hacker was able to access the data of 7 million customers.
See also: Costco confirms it suffered a card skimming attack
The data stolen during the attack includes: email addresses for 5 million customers, full names for 2 million other customers, name, date of birth and zip code for 300 people. Also, more information was exposed for ten people.
Robinhood also stated that the hacker tried to blackmail it, asking for money to keep the stolen data from being made public.
Stolen Robinhood customer data being sold on hacking forum
Two days after Robinhood disclosed the attack, a cybercriminal named “pompompurin” announced that customer data was being sold on a hacking forum.
In a forum post, pompompurin said he was selling information about 7 million Robinhood customers.
The data found for sale included the email addresses of the 5 million customers mentioned above, and the email addresses and full names of another batch of customers (2 million). However, Pompompurin said he was not selling the data of the 310 Robinhood customers most affected by the attack. These are the people whose most sensitive information, including ID cards, was exposed.
See also: Ransomware cyberattack on Danaos and Greek shipping companies
Robinhood did not initially disclose the theft of the ID cards, while the threat actor stated that he downloaded them from SendSafely, a secure file transfer service used by the trading platform when performing Know Your Customer (KYC) requirements.
“As we disclosed on November 8th, we experienced a data security incident and for a subset of approximately 10 customers, more extensive personal information and account details were exposed,” Robinhood told BleepingComputer about the data sale.
“These more extensive details included ID images for some of these 10 individuals. Like other financial companies, we collect and retain ID images for certain customers as part of our Know Your Customer checks, which are required by regulators.”
See also: Joker malware makes a comeback! 7 apps have been infected
Pompompurin told BleepingComputer that he tricked a Robinhood employee into installing remote access software on his computer.
This allowed him to gain access to the company's systems and customer data.
The hacker also published some screenshots from Robinhood's systems to prove the breach.
Source: Bleeping Computer
