{"meta":{"database":"Global Social Engineering Impact Database","license":"CC BY 4.0 — attribute to Netarx Social Engineering Incident Database","url":"https://global-social-engineering-impact-da.vercel.app/incidents/2026-kraken-refuses-extortion-after-two-support-insiders-accessed-client-data"},"incident":{"title":"Kraken refuses extortion after two support insiders accessed client data","date":"2026-04-13","date_precision":"day","victim_org":"Kraken","sector":"Cryptocurrency","country":"United States","primary_vector":"Insider Recruitment","secondary_vectors":[],"ai_involvement":"No AI reported","ai_notes":"No AI-generated media was reported in this case.","outcomes":["Extortion","Insider Access","Attempt Blocked"],"loss_usd":null,"loss_note":"Kraken refused to pay and reported no funds at risk; no loss figure disclosed.","records_affected":2000,"threat_actor":null,"summary":"CoinDesk reported on April 13, 2026 that Kraken faced an extortion attempt in which criminals threatened to release video purporting to show access to internal systems. The threat followed two separate incidents in which individuals on Kraken's support team gained inappropriate access to limited client support data. Roughly 2,000 client accounts, about 0.02 percent of the customer base, had limited data potentially viewed.","how_it_worked":"The route in was people, not software. Criminals worked through members of Kraken's own customer support team to reach client support data, mirroring the bribery-of-support-agents pattern seen at Coinbase a year earlier. The stolen material was then repackaged as leverage: the extortionists produced video framed to look like live access to Kraken's internal systems and demanded payment to suppress it. Kraken said its systems were never breached and that the access was terminated, controls tightened, affected clients notified, and law enforcement engaged, with sufficient evidence to identify those responsible.","lessons":"Scoped, justification-based access in support consoles plus insider-risk monitoring limits both what an insider can reach and how long it goes unnoticed.","confidence":"Confirmed","sources":[{"title":"Crypto exchange Kraken targeted in extortion attempt, but says there was no breach and no client funds at risk","url":"https://www.coindesk.com/business/2026/04/13/crypto-exchange-kraken-targeted-in-extortion-attempt-but-says-there-was-no-breach-and-no-client-funds-at-risk","publisher":"CoinDesk"}],"entry_type":"incident","slug":"2026-kraken-refuses-extortion-after-two-support-insiders-accessed-client-data","year":2026,"loss_kind":null,"url":"https://global-social-engineering-impact-da.vercel.app/incidents/2026-kraken-refuses-extortion-after-two-support-insiders-accessed-client-data"}}