Robinhood customer data theft via phone social engineering of support employee
On November 3, 2021 an attacker socially engineered a Robinhood customer support employee by phone and obtained access to customer support systems. Robinhood disclosed on November 8, 2021 that the attacker took email addresses for about 5 million people and full names for about 2 million others, then demanded an extortion payment.
- Victim
- Robinhood Markets
- Industry
- Financial services
- Country
- United States
- Intrusion began
- Nov 3, 2021
- First disclosed
- Nov 8, 2021
- Actor
- Financially motivated
- Initial access
- Credential phishing
- Identity control that failed
- Authentication
- MFA
- Not disclosed
- Abused identity
- Human account
- Records affected
- 7 million (About 5 million email addresses plus full names for a different group of about 2 million people, per Robinhood; about 310 had more data exposed and about 10 had extensive account details revealed.)
- Disclosed cost
- Not disclosed
The identity lesson
Phishing-resistant authentication for support staff and least-privilege limits on bulk export from support tools would have reduced a single phone call to a contained incident.
Sources
- Robinhood Announces Data Security Incident (Update), Robinhood, Nov 16, 2021
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- Dexcom internal documents accessed after targeted vishing 2026 · Credential phishing
- ASOS customer data reached with an employee login obtained by impersonation 2026 · Credential phishing
- RingCentral customer data stolen after a social engineering attack 2026 · Credential phishing
- Mixpanel smishing breach exposes OpenAI API user data 2025 · Credential phishing
Cite this record
SWI Community Team. (2026). Robinhood customer data theft via phone social engineering of support employee. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2021-robinhood-support-vishing/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.