Mailchimp slips up once more, suffers safety breach after falling on social engineering banana pores and skin • Graham Cluley

For the second time in lower than a yr, e-mail e-newsletter service Mailchimp has discovered itself within the embarrassing place of admitting it has suffered an information breach.

Mailchimp says {that a} social engineering assault succeeded in tricking Mailchimp workers and contractors into handing over their login credentials. Those particulars had been then efficiently utilized by a hacker to entry 133 Mailchimp accounts.

Mailchimp says that it contacted all affected account holders on January 12, lower than 24 hours after the safety breach was found.

Sign as much as our e-newsletter
Security information, recommendation, and suggestions.

One of these Mailchimp clients who seem to have been affected was WooCommerce, makers of a WordPress plugin that’s in style with companies working on-line shops.

WooCommerce contacted affected customers warning them that a few of their private info had been uncovered:

• Their title
• Their on-line retailer URL
• Their handle
• Email handle

Such info may clearly be exploited by attackers in, for example, phishing assaults. No doubt WooCommerce, and different Mailchimp customers, are lower than impressed that their personal clients have been put in danger because of Mailchimp’s safety slip-up.

Mailchimp is not any stranger to safety breaches.

In March 2022, Mailchimp found that an attacker had managed to entry a device utilized by its buyer assist crew, accessing 300 shopper accounts and efficiently stealing the subscriber knowledge from 102 of them.

Mailchimp clients who labored within the cryptocurrency and monetary sectors discovered that their accounts had been focused on that event, opening alternatives for scammers to ship out convincing (however malicious) emails to unsuspecting e-newsletter subscribers.

Then, as in the latest safety breach, the attacker used social engineering to dupe Mailchimp employees into handing over their login credentials.

Although Mailchimp seems to have acted comparatively promptly on this occasion, there should absolutely be questions requested as as to whether it’s doing sufficient to lock down entry to its inner instruments, and guaranteeing solely those that are actually authorised are in a position to entry them.

Found this text fascinating? Follow Graham Cluley on Twitter or Mastodon to learn extra of the unique content material we publish.