Mailchimp April 2022 support tool breach via social engineering

Mailchimp found on March 26, 2022 that an attacker was using an internal tool for customer support and account administration, after employee credentials were stolen through social engineering. The attacker viewed 319 accounts, mostly in crypto and finance, exported audience data from 102, and used the data for phishing such as a campaign against Trezor users. Mailchimp confirmed the incident in early April 2022.

Victim

Mailchimp (Intuit)

Industry

B2B SaaS

Country

United States

Intrusion began

Mar 26, 2022

First disclosed

Apr 4, 2022

Actor

Financially motivated

Initial access

Credential phishing

Identity control that failed

Authentication

MFA

Not disclosed

Abused identity

Human account

Records affected

319 (319 Mailchimp accounts viewed and audience data exported from 102, per Mailchimp.)

Disclosed cost

Not disclosed