Hide Techdirt is off for the long weekend! We'll be back with our regular posts tomorrow.

Hacker Tricked Robinhood Support Into Revealing Data Of 5 Million Users

from the whoops-a-daisy dept

When it comes to privacy and security, the weakest link continues to be of the human variety.

Trading app Robinhood last week announced in a blog post that somebody used social engineering to trick company support into handing over user login data. On November 3, said “hacker” convinced company support they were cleared to access ?certain customer support systems.? From there they nabbed the email addresses of five million users, and the full names of a different group of two million users:

“At this time, we understand that the unauthorized party obtained a list of email addresses for approximately five million people, and full names for a different group of approximately two million people. We also believe that for a more limited number of people?approximately 310 in total?additional personal information, including name, date of birth, and zip code, was exposed, with a subset of approximately 10 customers having more extensive account details revealed. We are in the process of making appropriate disclosures to affected people.”

Another subset of users had far more sensitive data exposed to the intruder. 310 users had their full names, dates of birth and ZIP codes exposed to the intruder, and 10 customers had “more extensive account details revealed” — though the company doesn’t specify which details they were. The company insists that no social security numbers were revealed and that nobody suffered any financial losses related to the attack:

“Based on our investigation, the attack has been contained and we believe that no Social Security numbers, bank account numbers, or debit card numbers were exposed and that there has been no financial loss to any customers as a result of the incident.”

By “no financial loss” Robinhood means none of their users had money stolen directly via Robinhood. That doesn’t mean those users won’t suffer financial losses elsewhere, after being bombarded with phishing emails over the next few months using the email addresses, or compromised via the release of other personal data used elsewhere.

As with most revelations of this type, the scope of the breach is probably significantly bigger than what’s currently understood. Also like most such breaches, nobody will remember it happened three months from now, and Robinhood won’t be held meaningfully accountable for its exploitable customer service. In a country where most companies have lax security and privacy standards, there’s no meaningful privacy law for the internet era, and FTC privacy enforcers that are routinely understaffed, under-funded, and simply outgunned, there’s simply not very much incentive to make security and privacy a real priority.

Filed Under: , , ,
Companies: robinhood

Rate this comment as insightful
Rate this comment as funny
You have rated this comment as insightful
You have rated this comment as funny
Flag this comment as abusive/trolling/spam
You have flagged this comment
The first word has already been claimed
The last word has already been claimed
Insightful Lightbulb icon Funny Laughing icon Abusive/trolling/spam Flag icon Insightful badge Lightbulb icon Funny badge Laughing icon Comments icon

Comments on “Hacker Tricked Robinhood Support Into Revealing Data Of 5 Million Users”

Subscribe: RSS Leave a comment
Khym Chanur (profile) says:

On November 3, said "hacker" convinced company support they were cleared to access “certain customer support systems.”

So did the attacker take over an existing employee account and then trick a sysadmin into granting that account more privileges? Or was it something really stupid like "I have no employee account, so use Teamviewer/LogMeIn/etc to let me take over your session and use your account"?

That Anonymous Coward (profile) says:

Re: Re: Re:

No you don’t.

mental drift net engage
Robinhood had NO Customer Service for a very long time.
After a couple lawsuits & bad publicity where there were suicides because the platform told young investors they were on the hook for ridiculous amounts of money & well no one was bothering to get back to the panicked emails from these users who believed what was on their screen, not understanding it wasn’t actually reality (which is a lesson everyone should learn about the market).
Then the very large blackeye of saving hedgefunds from stonks investors destroying them with GameStop stock, by just stopping trades, undoing trades, & suddenly inventing "rules" to protect the investors that only seemed to really help the Hedgefunds not crash.

They did a PR blitz, suddenly had a CSR team. Training optional, because it was basically mean to be like IT support with various tiers of CSR’s that exist to make sure the few skilled helpers (that Robinhood promoted but were as available as the Loch Ness Monster to most customers) remained elusive.

We take your privacy seriously, but only now that we’ve been caught with our pants down. If we had hired a slightly more expensive CSR team maybe we could have avoided this but our stock price mattered more at the time.

Besides there is no real penalty to us in this, tacking more credit monitoring on what already exceeds the consumers life span is cheap. There is no will in government to hold us accountable, and consumers have short memories. We’ll invent some great PR stories about an underdog getting rich & we’ll double our user base.

Add Your Comment

Your email address will not be published. Required fields are marked *

Have a Techdirt Account? Sign in now. Want one? Register here

Comment Options:

Make this the or (get credits or sign in to see balance) what's this?

What's this?

Techdirt community members with Techdirt Credits can spotlight a comment as either the "First Word" or "Last Word" on a particular comment thread. Credits can be purchased at the Techdirt Insider Shop »

Follow Techdirt

Techdirt Daily Newsletter

Techdirt Deals
Techdirt Insider Discord
The latest chatter on the Techdirt Insider Discord channel...