Chainalysis has updated its disclosure regarding a recent cyberattack, confirming that malicious actors gained access to sensitive user information. The company revealed that names, usernames, password hashes, and live tokens were exposed during the incident.
The firm initially reported on October 30 that the breach only affected non-sensitive data, such as user IDs, names, and email addresses. At that time, the company claimed there was no evidence of unauthorized access to authentication credentials or session tokens.
In a follow-up update on Wednesday, Chainalysis acknowledged a broader impact. The company identified an on-path attack that compromised some customer passwords. The firm stated that it has since contained the threat, remediated the attack vector, and initiated mandatory password resets for affected accounts.
Despite the expanded scope of the data breach, Chainalysis maintains that there is no evidence suggesting attackers accessed investigation data or manipulated attribution data. The company declined to provide further details regarding the extent of the exposure for individual users.
