Mailchimp internal support tool access via employee social engineering
On January 11, 2023 Mailchimp found an attacker inside an internal tool its customer-facing teams use for support and account administration. The attacker had run a social engineering campaign against Mailchimp employees and contractors and used the credentials it collected to log in, then viewed 133 customer accounts. It was Mailchimp's second support-tool compromise in under six months.
- Victim
- Mailchimp (Intuit)
- Industry
- B2B SaaS
- Country
- United States
- Intrusion began
- Jan 2023
- First disclosed
- Jan 13, 2023
- Actor
- Unattributed
- Initial access
- Credential phishing
- Identity control that failed
- Authentication
- MFA
- Not disclosed
- Abused identity
- Human account
- Records affected
- 133 (Mailchimp customer accounts accessed, per Mailchimp.)
- Disclosed cost
- Not disclosed
The identity lesson
Internal support and admin consoles that can see into any customer account need phishing-resistant authentication and tight per-session access, because a phished employee login becomes access to every customer.
Sources
- January 2023 security incident, Mailchimp, Jan 13, 2023
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- RingCentral customer data stolen after a social engineering attack 2026 · Credential phishing
- Mixpanel smishing breach exposes OpenAI API user data 2025 · Credential phishing
- Workday CRM contact data taken in a social engineering campaign 2025 · Credential phishing
- Retool SMS phishing, deepfaked call and Google Authenticator cloud sync 2023 · Credential phishing
Cite this record
SWI Community Team. (2026). Mailchimp internal support tool access via employee social engineering. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2023-mailchimp-employee-social-engineering/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.