NYDIG HubSpot Data Breach - Revision history

Azoundria: Another 30 minutes complete. All sources merged in. Prevention added. Information relocated around.

2023-07-07T17:41:42Z

Another 30 minutes complete. All sources merged in. Prevention added. Information relocated around.

← Older revision		Revision as of 11:41, 7 July 2023
Line 126:		Line 126:

	== Ultimate Outcome ==		== Ultimate Outcome ==
	~~What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?~~		=== Employee Responsible For Breach Fired ===
			The hacker compromised a HubSpot employee account and focused on stealing data from cryptocurrency industry customers<ref name="threatpost-8170" />. The "rogue" HubSpot employee was fired over the breach that targeted the company's cryptocurrency customers<ref name="threatpost-8170" />.
	=== Employee Fired ===
	"[The~~] rogue~~ employee ~~working at HubSpot – used by more than 135,000 (~~and ~~growing)~~ customers ~~to manage marketing campaigns and on~~-~~board new users – has been~~ fired over a breach that ~~zeroed in on~~ the ~~company’s~~ cryptocurrency customers~~, the company confirmed on Friday~~."

	=== FAQ Page Updated ===		=== FAQ Page Updated ===


	Hubspot reported upgrading security on their FAQ<ref name="hubspot-817122" />:<blockquote>Since the incident, we have taken steps to enhance our security and to prevent a similar attack from occurring in the future. While our investigation has concluded and remediation completed, we remain committed to improving our security through regular assessments and testing. </blockquote>		Hubspot reported upgrading security on their FAQ<ref name="hubspot-817122" />:<blockquote>Since the incident, we have taken steps to enhance our security and to prevent a similar attack from occurring in the future. While our investigation has concluded and remediation completed, we remain committed to improving our security through regular assessments and testing. </blockquote>

	== Total Amount Recovered ==		== Total Amount Recovered ==
	There do not appear to have been any funds ~~recovered~~ in this case.		There do not appear to have been any funds lost in this case.

	~~What funds~~ were ~~recovered? What funds were reimbursed for those affected users?~~		== Ongoing Developments ==
			HubSpot has provided limited details into their upgraded security model, and there are presently suspected to be dozens of other crypto companies who were also using HubSpot and did not publicly disclose this information breach.

	== Ongoing ~~Developments~~ ==		=== Ongoing Phishing Attack Risk ===
	~~What parts of this case are still remaining~~ to be ~~concluded?~~		Although no sensitive financial or personal data was included, security specialists have raised concerns about the potential for social engineering attacks using the exfiltrated information<ref name="threatpost-8170" />.

			=== Upgrades To HubSpot Security Model ===
			Hubspot reportedly has "taken steps" to "enhance" their security which they believe will "prevent a similar attack from occurring in the future". They "remain committed to improving [their] security through regular assessments and testing"<ref name="hubspot-8171222">[https://www.hubspot.com/en-us/march-2022-security-incident Information About HubSpot's March 18, 2022 Security Incident - Hubspot Website] (Jun 26, 2022)</ref>.<blockquote>Since the incident, we have taken steps to enhance our security and to prevent a similar attack from occurring in the future. While our investigation has concluded and remediation completed, we remain committed to improving our security through regular assessments and testing.</blockquote>With limited tangible details provided publicly, it remains to be seen how effective these new security measures will be at preventing future breaches.

	=== Many Companies Not Disclosing Breach ===		===Many Companies Not Disclosing Breach===
	According to Swan Bitcoin CEO Cory Klippsten reported that HubSpot had indicated "around 30 crypto companies [were affected by] the hack"<ref name="coryklippstentwitter-86182" />. The only companies which appear to have reported the breach so far are Swan Bitcoin, BlockFi, NYDIG, and Circle. (Pantera Capital suffered a separate HubSpot breach a year prior, and was not part of this incident.)		According to Swan Bitcoin CEO Cory Klippsten reported that HubSpot had indicated "around 30 crypto companies [were affected by] the hack"<ref name="coryklippstentwitter-86182" />. The only companies which appear to have reported the breach so far are Swan Bitcoin, BlockFi, NYDIG, and Circle. (Pantera Capital suffered a separate HubSpot breach a year prior, and was not part of this incident.)
	~~== General Prevention Policies ==~~
	Privacy-conscious customers can set up separate email addresses for each service easily, and avoid providing their phone number when possible. Any received emails must be viewed with scrutiny. Interact with companies only through their official websites and confirm anything with the company directly if it promises a significant reward or threatens access to your funds.

	~~Platforms should put in place multi-signature access control on~~ customer data~~, which requires~~ the ~~approval~~ of ~~multiple people to enable~~ the ~~mass download of data~~.		If this is true, it could indicate around 26 companies who had customer data breached and did not report the issue. Users of other cryptocurrency services should be on guard that their data may have been breached in the HubSpot incident.

	== Individual Prevention Policies ==		== Individual Prevention Policies ==
	{{Prevention:Individuals:~~Placeholder~~}}		Most companies have insecurities. Any information provided to a company may be breached or abused.

			=== Protection Of Personal Information ===
			Obviously, anything you can do to minimize the amount of information which you provide to websites will reduce your risk.

			{{Prevention:Individuals:Protect Personal Information}}

			=== Never Give Access To Your Funds ===
			In a typical cryptocurrency fraud, malicious actors try to use the available information to convince you to give them authorization to access or transfer funds. This can be accomplished via tricking you into providing a private key or seed phrase, signing a transaction that grants them permission to move funds, or installing malware on your device. In most cases, this will be accomplished via a greed or fear trigger, and you should be on extra guard when experiencing those emotions.

			{{Prevention:Individuals:Never Share Private Keys}}

			{{Prevention:Individuals:Always Verify Executables}}

			{{Prevention:Individuals:Store Funds Offline}}

	{{Prevention:Individuals:End}}		{{Prevention:Individuals:End}}
			== Platform Prevention Policies ==
			Platforms should put in place multi-signature access control on all customer data, which requires the approval of multiple people to enable the download of data. An external security review should be conducted regularly. If information is lost in a breach, the level of damage can be minimized by educating users about potential scams and frauds that they may encounter. Platforms should be prepared to assist with victims, which could be done through an industry insurance fund.

			{{Prevention:Platforms:Cryptocurrency Safety Quiz}}

			{{Prevention:Platforms:Implement Multi-Signature}}

			{{Prevention:Platforms:Regular Audit Procedures}}

	== Platform ~~Prevention Policies ==~~		{{Prevention:Platform:Supply Chain Assessment}}
	{{Prevention:Platforms:~~Placeholder~~}}
			{{Prevention:Platforms:Establish Industry Insurance Fund}}

	{{Prevention:Platforms:End}}		{{Prevention:Platforms:End}}
			== Regulatory Prevention Policies ==
			While the best solution is to reduce the amount of information collected, a combination of increased education, improved security, and a collective industry insurance fund can also prevent and mitigate the outcome of a similar data breach.

			=== Private Identity Key Protocol ===
			{{Prevention:Regulators:Private Identity Key Protocol}}

			=== Increased Education For Cryptocurrency Users ===
			{{Prevention:Regulators:Cryptocurrency Education Mandate}}

			=== Third Party Security Assessments ===
			{{Prevention:Regulators:Platform Security Assessments}}

	== ~~Regulatory Prevention Policies~~ ==		=== Establish Industry Insurance Fund ===
	{{Prevention:~~Regulators~~:~~Placeholder~~}}		{{Prevention:Platforms:Establish Industry Insurance Fund}}

	{{Prevention:Regulators:End}}		{{Prevention:Regulators:End}}

	== References ==		== References ==
	<references>		<references>

Azoundria: Another 30 minutes complete.

2023-06-28T16:42:05Z

Another 30 minutes complete.

Show changes

Azoundria: Adding Bitcoin Magazine article.

2023-04-25T17:10:05Z

Adding Bitcoin Magazine article.

← Older revision		Revision as of 11:10, 25 April 2023
Line 111:		Line 111:
	\|Blockworks Article Published		\|Blockworks Article Published
	\|Blockworks publishes an article on the situation. They reported multiple crypto companies were affected including NYDIG, Pantera Capital, BlockFi, Circle and Swan Bitcoin. They report that Pantera Capital was breached a month earlier, and reference a Tweet from a breach a year and a month ago. The data breach saw user information leaked to hackers, but not passwords or sensitive personal information. It is believed to have been a “targeted incident focused on customers in the cryptocurrency industry”. Affected companies maintain customer funds are still safe and secure, and are monitoring the situation closely. The full extent of the HubSpot hack is still unknown and the investigation is reportedly still ongoing<ref name="blockworks-86213">[https://blockworks.co/nydig-blockfi-pantera-circle-all-targeted-in-hubspot-data-breach/ NYDIG, BlockFi, Pantera, Circle All ‘Targeted’ in HubSpot Data Breach - Blockworks] (Jul 20, 2022)</ref>.		\|Blockworks publishes an article on the situation. They reported multiple crypto companies were affected including NYDIG, Pantera Capital, BlockFi, Circle and Swan Bitcoin. They report that Pantera Capital was breached a month earlier, and reference a Tweet from a breach a year and a month ago. The data breach saw user information leaked to hackers, but not passwords or sensitive personal information. It is believed to have been a “targeted incident focused on customers in the cryptocurrency industry”. Affected companies maintain customer funds are still safe and secure, and are monitoring the situation closely. The full extent of the HubSpot hack is still unknown and the investigation is reportedly still ongoing<ref name="blockworks-86213">[https://blockworks.co/nydig-blockfi-pantera-circle-all-targeted-in-hubspot-data-breach/ NYDIG, BlockFi, Pantera, Circle All ‘Targeted’ in HubSpot Data Breach - Blockworks] (Jul 20, 2022)</ref>.
			\|-
			\|March 21st, 2022 5:05:26 PM MDT
			\|Bitcoin Magazine Article
			\|Bitcoin Magazine publishes an article on the Hubspot data breach<ref>[https://web.archive.org/web/20220321230526/https://bitcoinmagazine.com/business/how-hubspot-data-breach-hits-bitcoiners How HubSpot Data Breach Hits Bitcoiners - Bitcoin Magazine Archive March 21st, 2022 5:05:26 PM MDT] (Apr 25, 2023)</ref>. They report the unauthorized user with "super admin" access exported contact lists and data, including IP addresses, email histories, customer browsing behavior, financial value, and help tickets. While financial data was not compromised, the loss of user persona and behavioral data is severe, and users should expect spear phishing and spam attacks. Users are advised to be cautious of unsolicited communications and to use privacy best practices when browsing, buying, and communicating online<ref name="bitcoinmagazine-8600">[https://bitcoinmagazine.com/business/how-hubspot-data-breach-hits-bitcoiners How HubSpot Data Breach Hits Bitcoiners - Bitcoin Magazine - Bitcoin News, Articles and Expert Insights] (Jul 19, 2022)</ref>.
	\|-		\|-
	\|March 22nd, 2022 3:10:55 AM MDT		\|March 22nd, 2022 3:10:55 AM MDT

Azoundria: Initial 30 minutes completed.

2023-04-24T22:14:22Z

Initial 30 minutes completed.

Show changes

Azoundria at 21:14, 10 April 2023

2023-04-10T21:14:43Z

← Older revision		Revision as of 15:14, 10 April 2023
Line 1:		Line 1:
	{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/nydighubspotdatabreach.php}}		{{Imported Case Study 2\|source=https://www.quadrigainitiative.com/casestudy/nydighubspotdatabreach.php}}
			{{Unattributed Sources}}

	[[File:Nydig.jpg\|thumb\|NYDIG]]NYDIG is an institution-grade bitcoin company offering multiple bitcoin-integrated products. They were reportedly among those companies affected by the Hubspot data breach. A third party tweet shows an email they have sent to athose affected. They they have not publicly confirmed the breach or made any further statements. There have been no specific reports I could locate of NYDIG clients being targeted subsequently.		[[File:Nydig.jpg\|thumb\|NYDIG]]NYDIG is an institution-grade bitcoin company offering multiple bitcoin-integrated products. They were reportedly among those companies affected by the Hubspot data breach. A third party tweet shows an email they have sent to athose affected. They they have not publicly confirmed the breach or made any further statements. There have been no specific reports I could locate of NYDIG clients being targeted subsequently.

	This exchange or platform is based in United States, or the incident targeted people primarily in United States.		This exchange or platform is based in United States, or the incident targeted people primarily in United States.<ref name="threatpost-8170" /><ref name="nydig-8612" /><ref name="nydig-8613" /><ref name="everybodywiki-8614" /><ref name="siliconrepublic-8176" /><ref name="hubspot-8171" /><ref name="hubspot-8615" /><ref name="hubspotlegal-8616" /><ref name="nobsbitcointwitter-8617" /><ref name="coryklippstentwitter-8618" /><ref name="twitterimage-8619" /><ref name="nydigarchive-8620" /><ref name="blockworks-8621" />

	== About NYDIG ==		== About NYDIG ==
Line 79:		Line 80:
	!Description		!Description
	\|-		\|-
	\|March 18th, 2022 ~~7:00:00 AM~~		\|March 18th, 2022
	\|Main Event		\|Main Event
	\|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.		\|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.
Line 106:		Line 107:
	== Ongoing Developments ==		== Ongoing Developments ==
	What parts of this case are still remaining to be concluded?		What parts of this case are still remaining to be concluded?
			== General Prevention Policies ==
	== Prevention Policies ==
	Privacy-conscious customers can set up separate email addresses for each service easily, and avoid providing their phone number when possible. Any received emails must be viewed with scrutiny. Interact with companies only through their official websites and confirm anything with the company directly if it promises a significant reward or threatens access to your funds.		Privacy-conscious customers can set up separate email addresses for each service easily, and avoid providing their phone number when possible. Any received emails must be viewed with scrutiny. Interact with companies only through their official websites and confirm anything with the company directly if it promises a significant reward or threatens access to your funds.

	Platforms should put in place multi-signature access control on customer data, which requires the approval of multiple people to enable the mass download of data.		Platforms should put in place multi-signature access control on customer data, which requires the approval of multiple people to enable the mass download of data.
			== Individual Prevention Policies ==
			{{Prevention:Individuals:Placeholder}}

			{{Prevention:Individuals:End}}

			== Platform Prevention Policies ==
			{{Prevention:Platforms:Placeholder}}

			{{Prevention:Platforms:End}}

			== Regulatory Prevention Policies ==
			{{Prevention:Regulators:Placeholder}}

			{{Prevention:Regulators:End}}

	== References ==		== References ==
	[https://threatpost.com/hubspot-data-breach-crytocurrency-industry/179086/ HubSpot Data Breach Ripples Through Crytocurrency Industry \| Threatpost] (Jun 20)		<references><ref name="threatpost-8170">[https://threatpost.com/hubspot-data-breach-crytocurrency-industry/179086/ HubSpot Data Breach Ripples Through Crytocurrency Industry \| Threatpost] (Jun 20, 2022)</ref>

	[https://nydig.com/ NYDIG - Bitcoin for All] (Jul 14)		<ref name="nydig-8612">[https://nydig.com/ NYDIG - Bitcoin for All] (Jul 14, 2022)</ref>

	[https://nydig.com/about-us About \| NYDIG - Bitcoin for All] (Jul 14)		<ref name="nydig-8613">[https://nydig.com/about-us About \| NYDIG - Bitcoin for All] (Jul 14, 2022)</ref>

	[https://en.everybodywiki.com/NYDIG NYDIG - EverybodyWiki Bios & Wiki] (Jul 14)		<ref name="everybodywiki-8614">[https://en.everybodywiki.com/NYDIG NYDIG - EverybodyWiki Bios & Wiki] (Jul 14, 2022)</ref>

	[https://www.siliconrepublic.com/enterprise/hubspot-data-breach-crypto-web3-bitcoin HubSpot hack leads to multiple Web3 and crypto company data breaches] (Jun 26)		<ref name="siliconrepublic-8176">[https://www.siliconrepublic.com/enterprise/hubspot-data-breach-crypto-web3-bitcoin HubSpot hack leads to multiple Web3 and crypto company data breaches] (Jun 26, 2022)</ref>

	[https://www.hubspot.com/en-us/march-2022-security-incident Information About HubSpot's March 18, 2022 Security Incident] (Jun 26)		<ref name="hubspot-8171">[https://www.hubspot.com/en-us/march-2022-security-incident Information About HubSpot's March 18, 2022 Security Incident] (Jun 26, 2022)</ref>

	[https://ir.hubspot.com/news/hubspots-statement-regarding-march-18-2022-security-incident HubSpot's Statement Regarding March 18, 2022 Security Incident] (Jul 20)		<ref name="hubspot-8615">[https://ir.hubspot.com/news/hubspots-statement-regarding-march-18-2022-security-incident HubSpot's Statement Regarding March 18, 2022 Security Incident] (Jul 20, 2022)</ref>

	[https://legal.hubspot.com/security HubSpot Security Program] (Jul 20)		<ref name="hubspotlegal-8616">[https://legal.hubspot.com/security HubSpot Security Program] (Jul 20, 2022)</ref>

	[https://twitter.com/nobsbitcoin/status/1505660801608126464 @nobsbitcoin Twitter] (Jul 20)		<ref name="nobsbitcointwitter-8617">[https://twitter.com/nobsbitcoin/status/1505660801608126464 @nobsbitcoin Twitter] (Jul 20, 2022)</ref>

	[https://twitter.com/coryklippsten/status/1505950666023268354 @coryklippsten Twitter] (Jul 20)		<ref name="coryklippstentwitter-8618">[https://twitter.com/coryklippsten/status/1505950666023268354 @coryklippsten Twitter] (Jul 20, 2022)</ref>

	[https://pbs.twimg.com/media/FOUqi9sVIAAXSQJ?format=jpg&name=large https://pbs.twimg.com/media/FOUqi9sVIAAXSQJ?format=jpg&name=large] (Jul 20)		<ref name="twitterimage-8619">[https://pbs.twimg.com/media/FOUqi9sVIAAXSQJ?format=jpg&name=large https://pbs.twimg.com/media/FOUqi9sVIAAXSQJ?format=jpg&name=large] (Jul 20, 2022)</ref>

	[https://web.archive.org/web/20220323175943/https://nydig.com/ NYDIG - Bitcoin for All] (Jul 20)		<ref name="nydigarchive-8620">[https://web.archive.org/web/20220323175943/https://nydig.com/ NYDIG - Bitcoin for All] (Jul 20, 2022)</ref>

	[https://blockworks.co/nydig-blockfi-pantera-circle-all-targeted-in-hubspot-data-breach/ NYDIG, BlockFi, Pantera, Circle All ‘Targeted’ in HubSpot Data Breach] (Jul 20)		<ref name="blockworks-8621">[https://blockworks.co/nydig-blockfi-pantera-circle-all-targeted-in-hubspot-data-breach/ NYDIG, BlockFi, Pantera, Circle All ‘Targeted’ in HubSpot Data Breach] (Jul 20, 2022)</ref></references>

Azoundria: Created page with "{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/nydighubspotdatabreach.php}} NYDIGNYDIG is an institution-grade bitcoin company offering multiple bitcoin-integrated products. They were reportedly among those companies affected by the Hubspot data breach. A third party tweet shows an email they have sent to athose affected. They they have not publicly confirmed the breach or made any further statements. There have been n..."

2023-01-28T16:55:24Z

Created page with "{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/nydighubspotdatabreach.php}} thumb|NYDIGNYDIG is an institution-grade bitcoin company offering multiple bitcoin-integrated products. They were reportedly among those companies affected by the Hubspot data breach. A third party tweet shows an email they have sent to athose affected. They they have not publicly confirmed the breach or made any further statements. There have been n..."

New page

{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/nydighubspotdatabreach.php}}

[[File:Nydig.jpg|thumb|NYDIG]]NYDIG is an institution-grade bitcoin company offering multiple bitcoin-integrated products. They were reportedly among those companies affected by the Hubspot data breach. A third party tweet shows an email they have sent to athose affected. They they have not publicly confirmed the breach or made any further statements. There have been no specific reports I could locate of NYDIG clients being targeted subsequently.

This exchange or platform is based in United States, or the incident targeted people primarily in United States.

== About NYDIG ==
"NYDIG is a bitcoin company that’s fusing high tech with institutional-grade finance to usher in a new era of financial products. We make it easy for partners to white label our solutions and create their own products like bitcoin accounts, rewards, and loyalty programs."

"We’re building an inclusive financial system that makes Bitcoin a universal option for billions of people worldwide. Bitcoin is a resource for human progress, and NYDIG is the gateway."

"NYDIG is a subsidiary of Stone Ridge, a holding company that has led the creation of forward-thinking firms across the worlds of technology and finance, including a $13B+ alternatives asset manager." "NYDIG was founded in 2017 by Ross Stevens and Robert Gutmann as New York Digital Investment Group, a subsidiary of Stone Ridge Holdings Group, based in New York.[1] In 2017, the company received a US$50 million Series A investment led by Bessemer Venture Partners. In October 2020, the company received a US$50 million growth equity round of funding, led by FinTech Collective, with Bessemer Venture Partners and Ribbit Capital participating."

"The breach has rippled through the crypto industry: As of Monday, crypto lending platform BlockFi, bitcoin-purchasing automation platform Swan Bitcoin, bitcoin company NYDIG, peer-to-peer payments technology company Circle and cryptocurrency fund Pantera Capital (which was hit a month prior) had been affected."

"Most individuals don’t understand the power of a CRM. At minimum, these tools allow companies to acquire, sort and manage incoming customers (and their data) in a way that provides the best user experience. At maximum, these tools are capable of an extreme degree of web monitoring and AI-based user segmentation and prediction."

"Multiple Web3 and crypto companies have been affected by a data breach at HubSpot, a marketing and sales platform that stores customer information."

"On March 15, a bad actor conducted a social engineering attack against a HubSpot employee that captured the employee’s credentials and persuaded the employee to provide the necessary multi-factor authentication. Between March 15 and March 17, the bad actor conducted reconnaissance within HubSpot’s internal systems. On March 17 and March 18, the bad actor exported contact data and user data from certain HubSpot customer accounts via an internal support tool called just-in-time-access (or JITA)."

"On Friday, March 18, 2022, NYDIG was made aware of a security incident at one of our vendors. Hubspot, which assists us with email communications and marketing." "Hubspot informed us that a bad actor compromised a Hubspot employee's account and may have gained access to contact information that NYDIG stores with Hubspot, which is limited to: Names, Email addresses, Phone numbers."

"HubSpot said on Saturday (19 March) that it became aware of a compromised employee account the previous day. The company believes data was exported from around 30 of its clients, “all of whom have been notified”."

"The breach has rippled through the crypto industry: As of Monday, crypto lending platform BlockFi, bitcoin-purchasing automation platform Swan Bitcoin, bitcoin company NYDIG, peer-to-peer payments technology company Circle and cryptocurrency fund Pantera Capital (which was hit a month prior) had been affected."

"Adam Healy, chief security officer at BlockFi, said that vendors like HubSpot who are “trusted with client information” are “subjected to a number of reviews.”"

"“However, even in those cases, vendors can make mistakes and as evidenced by Friday’s events have incidents that impact us and our clients,” Healy said in a statement sent to Blockworks."

"The investigation of the bad actor’s activity confirmed that this was a targeted attack focused on customers in the cryptocurrency industry. There was no evidence of suspicious activity within targeted customer accounts after March 18, 2022."

"While it is unclear what the attacker planned to do with this information, Coindesk reported that some users saw an uptick in phishing emails over the weekend, attempting to lure them into putting their passwords into a fake company website."

"To protect yourself, it is important that you exercise extra vigilance and care when reviewing or responding to emails, text messages, and phone calls, particularly those related to NYDIG. NYDIG will never send you an unprompted email to ask for your NYDIG account information, password, or Two-Factor Authentication (2FA) code. NYDIG will never send you an unprompted email providing a public key or wallet address for you to send Bitcoin or other digital assets, and will never request via email that you share any private key."

"[The] rogue employee working at HubSpot – used by more than 135,000 (and growing) customers to manage marketing campaigns and on-board new users – has been fired over a breach that zeroed in on the company’s cryptocurrency customers, the company confirmed on Friday."

"A full list of the affected clients has not been published, but [HubSpot] said it appeared to be a “targeted incident focused on customers in the cryptocurrency industry”."

"Since the incident, we have taken steps to enhance our security and to prevent a similar attack from occurring in the future. While our investigation has concluded and remediation completed, we remain committed to improving our security through regular assessments and testing."

"Hubspot says it's around 30 crypto companies in the hack. Fewer than 10 have divulged so far."

This exchange or platform is based in United States, or the incident targeted people primarily in United States.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

* Known history of when and how the service was started.
* What problems does the company or service claim to solve?
* What marketing materials were used by the firm or business?
* Audits performed, and excerpts that may have been included.
* Business registration documents shown (fake or legitimate).
* How were people recruited to participate?
* Public warnings and announcements prior to the event.

Don't Include:
* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
* Anything that wasn't reasonably knowable at the time of the event.
There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

== The Reality ==
This sections is included if a case involved deception or information that was unknown at the time. Examples include:

* When the service was actually started (if different than the "official story").
* Who actually ran a service and their own personal history.
* How the service was structured behind the scenes. (For example, there was no "trading bot".)
* Details of what audits reported and how vulnerabilities were missed during auditing.

== What Happened ==
The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.
{| class="wikitable"
|+Key Event Timeline - NYDIG HubSpot Data Breach
!Date
!Event
!Description
|-
|March 18th, 2022 7:00:00 AM
|Main Event
|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.
|-
|
|
|
|}

== Total Amount Lost ==
The total amount lost is unknown.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

== Immediate Reactions ==
How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

== Ultimate Outcome ==
What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

== Total Amount Recovered ==
There do not appear to have been any funds recovered in this case.

What funds were recovered? What funds were reimbursed for those affected users?

== Ongoing Developments ==
What parts of this case are still remaining to be concluded?

== Prevention Policies ==
Privacy-conscious customers can set up separate email addresses for each service easily, and avoid providing their phone number when possible. Any received emails must be viewed with scrutiny. Interact with companies only through their official websites and confirm anything with the company directly if it promises a significant reward or threatens access to your funds.

Platforms should put in place multi-signature access control on customer data, which requires the approval of multiple people to enable the mass download of data.

== References ==
[https://threatpost.com/hubspot-data-breach-crytocurrency-industry/179086/ HubSpot Data Breach Ripples Through Crytocurrency Industry | Threatpost] (Jun 20)

[https://nydig.com/ NYDIG - Bitcoin for All] (Jul 14)

[https://nydig.com/about-us About | NYDIG - Bitcoin for All] (Jul 14)

[https://en.everybodywiki.com/NYDIG NYDIG - EverybodyWiki Bios & Wiki] (Jul 14)

[https://www.siliconrepublic.com/enterprise/hubspot-data-breach-crypto-web3-bitcoin HubSpot hack leads to multiple Web3 and crypto company data breaches] (Jun 26)

[https://www.hubspot.com/en-us/march-2022-security-incident Information About HubSpot's March 18, 2022 Security Incident] (Jun 26)

[https://ir.hubspot.com/news/hubspots-statement-regarding-march-18-2022-security-incident HubSpot's Statement Regarding March 18, 2022 Security Incident] (Jul 20)

[https://legal.hubspot.com/security HubSpot Security Program] (Jul 20)

[https://twitter.com/nobsbitcoin/status/1505660801608126464 @nobsbitcoin Twitter] (Jul 20)

[https://twitter.com/coryklippsten/status/1505950666023268354 @coryklippsten Twitter] (Jul 20)

[https://pbs.twimg.com/media/FOUqi9sVIAAXSQJ?format=jpg&name=large https://pbs.twimg.com/media/FOUqi9sVIAAXSQJ?format=jpg&name=large] (Jul 20)

[https://web.archive.org/web/20220323175943/https://nydig.com/ NYDIG - Bitcoin for All] (Jul 20)

[https://blockworks.co/nydig-blockfi-pantera-circle-all-targeted-in-hubspot-data-breach/ NYDIG, BlockFi, Pantera, Circle All ‘Targeted’ in HubSpot Data Breach] (Jul 20)