Mailchimp August 2022 support tool breach via phished credentials
Mailchimp's security team became aware on August 8, 2022 that an actor had used a social engineering attack on employees and their compromised credentials to access an internal customer support and account administration tool, targeting users in crypto and finance. Mailchimp said 214 accounts were affected; it was the second such incident in five months.
- Victim
- Mailchimp (Intuit)
- Industry
- B2B SaaS
- Country
- United States
- Intrusion began
- Aug 2022
- First disclosed
- Aug 12, 2022
- Actor
- Financially motivated
- Initial access
- Credential phishing
- Identity control that failed
- Authentication
- MFA
- Not disclosed
- Abused identity
- Human account
- Records affected
- 214 (214 Mailchimp accounts, per Mailchimp.)
- Disclosed cost
- Not disclosed
The identity lesson
A repeat of the same path months later shows the fix has to be structural: phishing-resistant authenticators for every user of privileged support tools.
Sources
- Information About a Recent Security Incident Targeting Crypto Companies, Mailchimp, Aug 12, 2022
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- RingCentral customer data stolen after a social engineering attack 2026 · Credential phishing
- Mixpanel smishing breach exposes OpenAI API user data 2025 · Credential phishing
- Workday CRM contact data taken in a social engineering campaign 2025 · Credential phishing
- Retool SMS phishing, deepfaked call and Google Authenticator cloud sync 2023 · Credential phishing
Cite this record
SWI Community Team. (2026). Mailchimp August 2022 support tool breach via phished credentials. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2022-mailchimp-internal-tool-august/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.