Chainalysis Says Cyberattack Exposed Password Hashes and Tokens

Chainalysis said an updated investigation into a cyberattack found that names, usernames, password hashes and live tokens associated with all its users had been exposed to a malicious actor. The company did not clarify whether every listed data type was exposed for every user. The disclosure, made in a November 4 security update, expanded the scope of information it had initially reported exposed after detecting an intrusion on October 30. Chainalysis also said a separate on-path attack exposed passwords for a subset of customers. It said the attack method had been contained and remediated, and that affected accounts were being locked. The company has not said how many customers were affected by that password exposure. The incident prompted Chainalysis to take several products offline after it detected abnormal activity. The company said it removed access to its Know Your Transaction (KYT) interface and API, other address-screening products and its login page. Reactor and Data Solutions were also offline during security work. Chainalysis did not provide a restoration date for Reactor or Data Solutions. The company said it planned to begin restoring KYT and Address Screening on...