What happened
On 18 March 2022 the CRM and marketing platform HubSpot disclosed that a threat actor had compromised a HubSpot employee account and used internal employee tooling to export contact data from a small number of customer portals. The targeting focused on cryptocurrency companies; BlockFi, Swan Bitcoin, NYDIG, Circle and Pantera Capital were among the customers that notified their users. HubSpot terminated the employee's access and disabled the affected accounts.
How the deception worked
The attacker gained control of a single HubSpot employee's account and then used the internal support tooling that comes with it. That tooling is designed to let staff assist customers by reaching into their portals, so once inside there was no further exploitation required, only the normal use of a legitimate function. The attacker moved directly to cryptocurrency customers, exported their marketing contact lists, and thereby obtained the names, email addresses and in some cases phone numbers of people known to hold crypto, which is precisely the targeting list for follow-on phishing. Downstream customers had no visibility into the vendor account that held their data.
The control that would have caught it· our reading, not a claim from the sources
Internal support tooling that can read customer data needs per-access justification, strict scoping and export alerting, so one compromised staff account cannot silently harvest many tenants.
Sources (2)
- Cryptocurrency Services Hit by Data Breach at CRM Company HubSpotSecurityWeek·securityweek.comOpen ↗
- HubSpot Data Breach Ripples Through Cryptocurrency IndustryThreatpost·threatpost.comOpen ↗
This entry summarises public reporting. It is not a legal finding, and details can change as investigations conclude. Found an error? Send a correction.