Chainalysis says breach exposed credentials and tokens for all users

Chainalysis said on Nov. 4 that names, usernames, password hashes and live tokens for all its users had been exposed to a malicious actor, widening the company’s account of an October cyberattack. The Chainalysis incident notice said the company had discovered the exposure on Monday and still had no evidence that investigation data was accessed or attribution data manipulated.

What information did the attacker access?

Chainalysis said the exposed information included names, usernames, password hashes and live tokens tied to all users. The company did not disclose how many users that represents or specify whether each data type was exposed for every user, Cointelegraph reported.

Separately, Chainalysis said an “on-path attack” exposed a subset of customer passwords. It said that attack vector had been contained and remediated, and required affected customers to reset their passwords.

Which Chainalysis services were affected?

On Nov. 4, Chainalysis took its Know Your Transaction interface and API, address screening products and login page offline after detecting abnormal activity. Reactor, Data Solutions and Chain (Beta) were also offline as the company worked to secure systems.

Chainalysis said on Nov. 7 that Reactor, KYT and Address Screening were back online with enhanced security measures. Its notice said Data Solutions remained under restoration work.

What must customers do to regain access?

Chainalysis said customers must provide trusted IP addresses for allowlisting before access is restored. Users are required to reset passwords and rotate API keys where applicable; the company said some KYT accounts appeared to have been accessed without authorization.

Sources

• Chainalysis incident notice — chainalysis.com
• Cointelegraph reported — cointelegraph.com