Server racks in a 2015 archive photograph illustrating computer infrastructure. Not identified as Chainalysis systems or the equipment involved in the incident.
Photo: Carl Lender / Wikimedia Commons / CC BY 2.0.
Chainalysis disclosed Friday that an external attacker gained unauthorized access to its systems and internal tools, exposing some customer user IDs, full names, email addresses and organization-role labels.
In its October 30 security notice, the company said it detected the activity this month and described the attacker as using “offensive agentic techniques.” It did not give a detailed account of how the intrusion worked or identify the attacker.
Based on its investigation so far, Chainalysis said it had found no evidence of unauthorized access to investigation content or authentication credentials and session tokens. Its customer notice specifically listed investigation graphs, notes and cases; transaction or query results; passwords in clear text; multifactor-authentication secrets; and user session tokens among the data for which it had found no indication of access.
That assessment is provisional. The company said it was still determining which records belonging to individual customer organizations had been accessed and would provide a detailed breakdown once that analysis was complete.
Chainalysis said the incident is unrelated to the recent cryptocurrency theft at Binance. Its notice did not state how many customers or users were affected, disclose a financial loss or say that cryptocurrency had been stolen in this incident.
The company said it had notified all customers, engaged outside cybersecurity specialists, patched vulnerabilities and begun a broader security review extending beyond the vulnerabilities used in the attack. It also said it was using large language models to support that review.
Chainalysis urged users to remain alert for unexpected password-reset requests and authentication prompts. It recommended enabling two-factor authentication for organizations that had not already done so.
The company said it would provide customers with further updates as its investigation progresses.
JBizNews Desk | Cybersecurity
© JBizNews.com. All rights reserved. Unauthorized reproduction or redistribution is strictly prohibited.
.jpg){kind=link}