Robinhood Data Breach: Hacker Tricked Customer Support Employee By Phone

Stock trading platform Robinhood announced that certain customer support systems were hacked in early November. The unauthorized party was able to gain access using social engineering through a customer support employee by phone. The hacker was able to obtain access to a list of email addresses of about five million people, and full names of a different group of two million people.

In a statement, the company reported around 310 customers’ personal information, such as name, date of birth, and zip codes were exposed with a subset of around ten customers having more extensive account details revealed, although it did not disclose what the details were.

Following the breach, the unauthorized party demanded an extortion payment. Robinhood informed law enforcement and is continuing to investigate the incident with an outsourced security firm. The company did not disclose how much the hackers demanded.

“As a Safety First company, we owe it to our customers to be transparent and act with integrity,” said Robinhood’s Chief Security Officer Caleb Sima, in a statement. “Following a diligent review, putting the entire Robinhood community on notice of this incident now is the right thing to do.”

Robinhood says it is in the process of making disclosures to those affected, and added that no social security numbers, bank account numbers, or debit card numbers were exposed. According to the company, there has been no financial loss to any customers as a result of the incident.

To avoid being a victim of an attack like this, the Cyber Security Infrastructure Security Agency (CISA) recommends being suspicious of unsolicited phone calls, visits, or email messages from individuals asking about employees or other internal information.

If an unknown individual claims to be from a legitimate organization, CISA recommends verifying his or her identity directly with the company and to never provide personal information or information about your organization, including its structure or networks, unless you are certain of a person’s authority to have the information.