Chainalysis says hackers stole credentials and tokens for all of its customers

Blockchain analysis firm Chainalysis said that hackers have obtained sensitive personal information—including names, usernames, password hashes, and live tokens—for all of its users following a breach of its network security. The accomplishment could be a major coup for the attackers. Both Chainalysis and public sources have revealed a long list of high-profile customers, including government agencies such as the FBI, US Immigration and Customs Enforcement agency, and the US Air Force, as well as private companies such as Microsoft, Coinbase, and Barclays. It’s unclear if the data theft exposed customers to additional threats. Last Friday, Chainalysis said it had been the target of a cybersecurity incident in October that was similar to the hacks of other platforms during the same month. The external actor used AI agent-assisted offensive techniques to gain unauthorized access to Chainalysis systems and internal tools. An email the company sent to affected customers said some “non-sensitive customer data, such as user IDs, full names, email addresses, and organization role labels for users provisioned on our platform were accessed.” It’s not clear why the company considered such information “non-sensitive.” In a Wednesday update, the company said that part of the “ongoing multifront cyberattack” involved an “on-path attack” that exposed a subset of customer passwords, and that the attack vector had been identified and fixed. Also known as an adversary-in-the-middle attack, on-path attacks happen when a hacker gains access to a piece of infrastructure sending traffic back and forth between two parties. Chainalysis has yet to say where the infrastructure compromise occurred and if the data obtained from it was TLS encrypted.