Blockchain analytics firm Chainalysis has expanded its disclosure of a recent security breach, confirming that attackers obtained names, usernames, password hashes, and valid authentication tokens belonging to all of its users. The company also revealed that some customers' plaintext passwords were exposed through a separate attack method.

The updated security incident notice provides a broader account of the compromised information than the company initially disclosed. It confirms that the exposure extended beyond customer identity information to include authentication-related data, as reported by Wu Blockchain on X, raising the significance of the incident for users accessing Chainalysis services.

Services Suspended and Password Resets Required

Following the detection of abnormal activity, Chainalysis suspended several services as part of its response. The affected services included Know Your Transaction (KYT) transaction monitoring, address screening, and login services. KYT monitoring and address screening are compliance-focused services used to monitor cryptocurrency transactions and screen blockchain addresses for suspicious activity.

The company also required all users to reset their passwords and instructed users to rotate their API keys where necessary. These measures were outlined in the updated incident notice as part of the company's response to the exposure.

The confirmation that valid authentication tokens were accessed marks a significant addition to the incident report. Unlike information such as names and usernames, authentication tokens are used in access-related processes. Chainalysis confirmed that valid tokens belonging to all users had been exposed to the attacker.

The company further stated that some customers' plaintext passwords were leaked through a separate attack method. This detail distinguishes the plaintext password exposure from the disclosure of password hashes and indicates that the incident involved more than one method of obtaining user authentication information. The two categories differ technically: password hashes are one-way derived representations of passwords rather than the passwords themselves, while plaintext passwords are the working credentials for the customers whose data was exposed through that method.

Earlier Disclosure on October 30

Chainalysis first announced the breach on October 30 when it disclosed that a hacker had used offensive AI agent technology in the attack. At that stage, the company confirmed that certain customer identity information had been accessed.

However, the initial announcement said Chainalysis had found no evidence that passwords or session tokens had been leaked. The updated notice subsequently provided additional information, confirming that password hashes and valid authentication tokens had been exposed, while some plaintext passwords were also compromised through a separate attack method.

The difference between the initial disclosure and the updated notice reflects the expanded scope of information confirmed by the company as it continued addressing the incident. The latest statement identifies the categories of user information exposed and details the service suspensions and account-security measures required in response.

Chainalysis's updated notice confirms that the exposure affected information associated with all users, while the plaintext password disclosure applied to some customers. The company required password resets for all users and API key rotation where necessary. For users of Chainalysis services, the updated incident notice stands as the company's most current public accounting of the incident.

Source: Hokanews