FanDuel Sportsbook is warning its customers that their personal data may have been exposed due to the hack suffered by MailChimp in January 2023. Accordingly, FanDuel urges all consumers to be cautious and watch out for potential phishing emails.
See also: Hook Android malware: Learn everything about the new big threat
Be careful with phishing attacks – they are malicious attempts to get you to click on a link or open an attachment, usually disguised as an email from a trusted source. If unsuspecting users take action by clicking on these links, hackers can gain access to your personal data and exploit it for their own benefit. To avoid this, always double-check before opening any email that unexpectedly arrives in your inbox!
See also: Vastflux ad scam affected more than 11 million devices
On January 13, MailChimp reported a breach of its systems caused by hackers who obtained an employee's credentials through a social engineering attack.
With the aforementioned information, malicious actors used an internal MailChimp customer support and management tool to extract data from 133 customers.
MailChimp audience data is unique to each user and typically includes the emails and names of current or prospective customers to whom marketing emails are sent.
Last Thursday, FanDuel sent an email to its customers warning of a MailChimp security breach that allowed threat actors to gain access to their names and emails.
FanDuel clarified that the hackers were not able to access users' passwords, financial account , or any other type of personal data during the breach. This confirms that there was no intrusion into their systems or any FanDuel user accounts.
Although the security alert did not name MailChimp as the third-party vendor that had been hacked, FanDuel confirmed to BleepingComputer that it was indeed them.
See also: Roaming mantis Android malware upgraded
“Be alert”
FanDuel is warning its customers to remain vigilant against phishing attacks and account takeover attempts, in light of the data breach they recently experienced.
FanDuel advises its customers to frequently update their passwords, enable two-factor authentication (MFA) on their accounts, and be cautious when clicking on links in unauthorized password reset.
While current evidence suggests that stolen MailChimp credentials are not being used for malicious purposes, in the past threat actors have used this type of data in malicious phishing campaigns.
In April 2022, malicious hackers breached MailChimp's security protocols to gain unauthorized access to marketing email data for the Trezor hardware wallet.
This data was then used in a malicious phishing campaign, which sent false data breach, promoting malware to steal cryptocurrency wallets.
Additionally, FanDuel accounts are highly sought after by cybercriminals, who are constantly trying to hack into customers' accounts using credential-stuffing attacks.
Stolen accounts are being sold for as little as two dollars on the dark web, depending on their value or the payment information associated with them.
Enabling MFA on a FanDuel account using an authenticator app will make account theft much more difficult, even if a threat actor gains access to a customer's credentials.
Many account breaches can be attributed to the use of the same credentials across multiple websites. This allows malicious actors to exploit data breaches and attempt to log into your accounts on different websites. To protect yourself from these security threats, it is important to create unique and secure passwords for each website you visit.
Information source: bleepingcomputer.com
