Introduction
Another new week, another hacking incident reported. This time around, it is the popular crypto aggregator service Coingecko. The platform has confirmed reports making the rounds in the crypto community that user email accounts have been hacked. This hacking incident happened with the platform's third-party email service provider on June 5, 2024. Below is the official announcement and confirmation of the incident by Coingecko.
On June 5, 2024, around 06:30 AM UTC, we detected unusual activity on our third-party email marketing platform, GetResponse. An attacker had compromised a GetResponse employee’s account, leading to a breach. We received confirmation from the GetResponse team on 6 June, 2024, at 11:58 AM UTC, that a data breach had occurred. source
This is really an unfortunate event which adds to the growing number of hacking attacks on blockchain platforms. Coingecko went on to explain the details of what happened, the extent of recovery activities and what steps need to be taken by everyone that has an account on the platform. Details about that from the next paragraph - plus what you could do to protect yourself from email scams.
1,916,596 emails accounts breached - what happened
GetResponse is one of the 3rd-party email services used by CoinGecko. It was where the actual hacking event happened and not on Coingecko platform. While GetResponse is not the main provider, the attack resulted in a significant loss of personal details of millions of users through their email addresses. The attack originated from the compromising of one of GetResponse admin emails.
The Coingecko official confirmation reports that the attack resulted in the loss of 1,916,596 email account details of its users. It surely did not end there. The attackers have already sent massive spam mails to the accounts breached - up to 23,723 fraudulent emails were sent to the compromised email addresses.
Coingecko has quickly worked to contain the extent of damage. Every address that is affected by this data breach have been personally contacted by CoinGecko to get them informed. Some of the data that was lost include names of the users, IP addresses and other personally identifying data.
Coingecko has advised users to beware of any emails purported to be from them. Users must be careful before they click any email marketing links in order not to fall victim to the attackers. Interestingly, the breach did not uncover login details of users on CoinGecko platform such as their passwords. Hence their accounts on the platform remain unaffected by the attack. However, users must take steps and be wary of further attacks such as phishing schemes that may result from the personal data leaked in this hacking incident.
What attackers do with stolen email accounts
When such attacks happen, the first target of the intruders is to send misleading email to the victims posing as the organization that users belong. Just as this case illustrated already, the attackers have sent a massive amount of emails to Coingecko users involved in the breaching incident. These emails often contain messages that are meant to steal from the users in one or all of the following ways:
- Phishing link: The attackers might have cloned the official website of the organization. These phishing websites are designed to look every inch exactly like the original one. Users who are not careful might not quickly spot the difference until damages have happened. Once they have the fraudulent website, they then send the malicious URL through a phishing email.
Users are often encouraged to click the link contained in the email. Once they do, they are led to the cloned website which looks just the way the original website look. They are prompted to enter their login details which is all the attackers need. If they succeed in getting this information, the next is history. They can wipe out entire crypto assets from a wallet, steal all the money from a credit card or bank account, or commit other crimes using the stolen login details.
- Download attachments: If the attackers choose not to steal through a phishing website, they might include malicious files in the phishing email and ask the victims to download them. The attachments might contain Malware or other malicious program that once installed, steals data from the device where it was installed.
Malwares could be used to steal personal login details saved on a device. Such personal data like passwords, credit card numbers, phone numbers, social security numbers, etc. Malwares could also be used to launch ransomeware attacks where a device is remotely locked and controlled by a criminal until some ransom is paid to release it.
- Personal Identity crimes: Another thing that could happen when email accounts are stolen is sending messages to the contacts of the email address, impersonating as the owner of the email. The attackers might try to extort from the contacts, steal from them, ask them send money or do other activities that could lead to further loss.
Attackers might pretend to be the person whose email has been stolen and cook up lies such as being involved in an accident or in a hospital emergency ward. They then ask funds to be sent urgently to help them with the situation. Some attackers have feigned being kidnapped and ask for ransom to be paid by the victims parents, friends or other contacts found connected with the stolen email.
The truth is that there no end to what attackers might choose to do with a stolen email. Whatever would fetch them money is just at the mercy of their imagination.
Stay safe before and after email breaches
The standard precautionary measures to be taken to protect oneself especially after a breaching event are same as the ones that Coingecko suggested below:
Please stay vigilant and exercise caution when opening any emails, as there could be an increase in phishing or spam emails. Be cautious of emails from unfamiliar or misleading domains. Avoid clicking on links or downloading attachments from unsolicited sources. Be wary of emails that claim to offer token airdrops. source
One important thing to note is that GetResponse is not an exclusive email provider for CoinGecko. This simply means that all other services, organizations and platforms that use GetResponse are involved in the breach. So everyone needs to be careful as there could be a surge in the number of unsolicitated emails that the attackers would be sending from all the stolen emails accounts - both Coingecko and every other GetResponse client.
Note: Thumbnail is from pixabay