Swan Bitcoin Hubspot Data Breach - Revision history

Azoundria: Another 30 minutes complete. All sources merged in. Prevention added. Information relocated around.

2023-07-07T17:38:15Z

Another 30 minutes complete. All sources merged in. Prevention added. Information relocated around.

Show changes

Azoundria: Another 30 minutes complete.

2023-06-28T16:40:56Z

Another 30 minutes complete.

Show changes

Azoundria: Adding Bitcoin Magazine article.

2023-04-25T17:09:58Z

Adding Bitcoin Magazine article.

← Older revision		Revision as of 11:09, 25 April 2023
Line 102:		Line 102:
	\|Blockworks Article Published		\|Blockworks Article Published
	\|Blockworks publishes an article on the situation. They reported multiple crypto companies were affected including NYDIG, Pantera Capital, BlockFi, Circle and Swan Bitcoin. They report that Pantera Capital was breached a month earlier, and reference a Tweet from a breach a year and a month ago. The data breach saw user information leaked to hackers, but not passwords or sensitive personal information. It is believed to have been a “targeted incident focused on customers in the cryptocurrency industry”. Affected companies maintain customer funds are still safe and secure, and are monitoring the situation closely. The full extent of the HubSpot hack is still unknown and the investigation is reportedly still ongoing<ref name="blockworks-8621">[https://blockworks.co/nydig-blockfi-pantera-circle-all-targeted-in-hubspot-data-breach/ NYDIG, BlockFi, Pantera, Circle All ‘Targeted’ in HubSpot Data Breach - Blockworks] (Jul 20, 2022)</ref>.		\|Blockworks publishes an article on the situation. They reported multiple crypto companies were affected including NYDIG, Pantera Capital, BlockFi, Circle and Swan Bitcoin. They report that Pantera Capital was breached a month earlier, and reference a Tweet from a breach a year and a month ago. The data breach saw user information leaked to hackers, but not passwords or sensitive personal information. It is believed to have been a “targeted incident focused on customers in the cryptocurrency industry”. Affected companies maintain customer funds are still safe and secure, and are monitoring the situation closely. The full extent of the HubSpot hack is still unknown and the investigation is reportedly still ongoing<ref name="blockworks-8621">[https://blockworks.co/nydig-blockfi-pantera-circle-all-targeted-in-hubspot-data-breach/ NYDIG, BlockFi, Pantera, Circle All ‘Targeted’ in HubSpot Data Breach - Blockworks] (Jul 20, 2022)</ref>.
			\|-
			\|March 21st, 2022 5:05:26 PM MDT
			\|Bitcoin Magazine Article
			\|Bitcoin Magazine publishes an article on the Hubspot data breach<ref>[https://web.archive.org/web/20220321230526/https://bitcoinmagazine.com/business/how-hubspot-data-breach-hits-bitcoiners How HubSpot Data Breach Hits Bitcoiners - Bitcoin Magazine Archive March 21st, 2022 5:05:26 PM MDT] (Apr 25, 2023)</ref>. They report the unauthorized user with "super admin" access exported contact lists and data, including IP addresses, email histories, customer browsing behavior, financial value, and help tickets. While financial data was not compromised, the loss of user persona and behavioral data is severe, and users should expect spear phishing and spam attacks. Users are advised to be cautious of unsolicited communications and to use privacy best practices when browsing, buying, and communicating online<ref name="bitcoinmagazine-8600">[https://bitcoinmagazine.com/business/how-hubspot-data-breach-hits-bitcoiners How HubSpot Data Breach Hits Bitcoiners - Bitcoin Magazine - Bitcoin News, Articles and Expert Insights] (Jul 19, 2022)</ref>.
	\|-		\|-
	\|March 22nd, 2022 3:10:55 AM MDT		\|March 22nd, 2022 3:10:55 AM MDT

Azoundria: Initial 30 minutes completed.

2023-04-24T22:14:08Z

Initial 30 minutes completed.

Show changes

Azoundria at 21:14, 10 April 2023

2023-04-10T21:14:59Z

← Older revision		Revision as of 15:14, 10 April 2023
Line 1:		Line 1:
	{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/swanbitcoinhubspotdatabreach.php}}		{{Imported Case Study 2\|source=https://www.quadrigainitiative.com/casestudy/swanbitcoinhubspotdatabreach.php}}
			{{Unattributed Sources}}

	[[File:Swanbitcoin.jpg\|thumb\|Swan Bitcoin]]Swan Bitcoin is a platform which assists users in saving money in bitcoin by allowing easy routine purchases. The company used HubSpot to assist with managing their customer relationships. HubSpot suffered a data breach and names, email addresses, and phone numbers of customers were leaked. An announcement was made and the employee at the company who enabled the breach has been fired. Customers must be aware for future phishing scams which may target them.		[[File:Swanbitcoin.jpg\|thumb\|Swan Bitcoin]]Swan Bitcoin is a platform which assists users in saving money in bitcoin by allowing easy routine purchases. The company used HubSpot to assist with managing their customer relationships. HubSpot suffered a data breach and names, email addresses, and phone numbers of customers were leaked. An announcement was made and the employee at the company who enabled the breach has been fired. Customers must be aware for future phishing scams which may target them.

	This is a global/international case not involving a specific country.		This is a global/international case not involving a specific country.<ref name="stackthosesatstwitter-8172" /><ref name="threatpost-8170" /><ref name="swanbitcointwitter-8173" /><ref name="swanbitcoin-8174" /><ref name="swanbitcointwitter-8175" /><ref name="hubspot-8171" /><ref name="siliconrepublic-8176" />

	== About Swan Bitcoin ==		== About Swan Bitcoin ==
Line 61:		Line 62:
	!Description		!Description
	\|-		\|-
	\|March 19th, 2022 1:13:00 PM		\|March 19th, 2022 1:13:00 PM MDT
	\|Main Event		\|Main Event
	\|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.		\|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.
Line 88:		Line 89:
	== Ongoing Developments ==		== Ongoing Developments ==
	What parts of this case are still remaining to be concluded?		What parts of this case are still remaining to be concluded?
			== General Prevention Policies ==
	== Prevention Policies ==
	Privacy-conscious customers can set up separate email addresses for each service easily, and avoid providing their phone number when possible. Any received emails must be viewed with scrutiny. Interact with companies only through their official websites and confirm anything with the company directly if it promises a significant reward or threatens access to your funds.		Privacy-conscious customers can set up separate email addresses for each service easily, and avoid providing their phone number when possible. Any received emails must be viewed with scrutiny. Interact with companies only through their official websites and confirm anything with the company directly if it promises a significant reward or threatens access to your funds.

	Platforms should put in place multi-signature access control on all customer data, which requires the approval of multiple people to enable the download of data.		Platforms should put in place multi-signature access control on all customer data, which requires the approval of multiple people to enable the download of data.
			== Individual Prevention Policies ==
			{{Prevention:Individuals:Placeholder}}

			{{Prevention:Individuals:End}}

			== Platform Prevention Policies ==
			{{Prevention:Platforms:Placeholder}}

			{{Prevention:Platforms:End}}

			== Regulatory Prevention Policies ==
			{{Prevention:Regulators:Placeholder}}

			{{Prevention:Regulators:End}}

	== References ==		== References ==
	[https://twitter.com/stackthosesats/status/1505136787810922499 @stackthosesats Twitter] (Jun 20)		<references><ref name="stackthosesatstwitter-8172">[https://twitter.com/stackthosesats/status/1505136787810922499 @stackthosesats Twitter] (Jun 20, 2022)</ref>

	[https://threatpost.com/hubspot-data-breach-crytocurrency-industry/179086/ HubSpot Data Breach Ripples Through Crytocurrency Industry \| Threatpost] (Jun 20)		<ref name="threatpost-8170">[https://threatpost.com/hubspot-data-breach-crytocurrency-industry/179086/ HubSpot Data Breach Ripples Through Crytocurrency Industry \| Threatpost] (Jun 20, 2022)</ref>

	[https://twitter.com/SwanBitcoin/status/1506355008127877123 @SwanBitcoin Twitter] (Jun 26)		<ref name="swanbitcointwitter-8173">[https://twitter.com/SwanBitcoin/status/1506355008127877123 @SwanBitcoin Twitter] (Jun 26, 2022)</ref>

	[https://www.swanbitcoin.com/ https://www.swanbitcoin.com/] (Jun 26)		<ref name="swanbitcoin-8174">[https://www.swanbitcoin.com/ https://www.swanbitcoin.com/] (Jun 26, 2022)</ref>

	[https://twitter.com/SwanBitcoin/status/1505261139571191813 @SwanBitcoin Twitter] (Jun 26)		<ref name="swanbitcointwitter-8175">[https://twitter.com/SwanBitcoin/status/1505261139571191813 @SwanBitcoin Twitter] (Jun 26, 2022)</ref>

	[https://www.hubspot.com/en-us/march-2022-security-incident Information About HubSpot's March 18, 2022 Security Incident] (Jun 26)		<ref name="hubspot-8171">[https://www.hubspot.com/en-us/march-2022-security-incident Information About HubSpot's March 18, 2022 Security Incident] (Jun 26, 2022)</ref>

	[https://www.siliconrepublic.com/enterprise/hubspot-data-breach-crypto-web3-bitcoin HubSpot hack leads to multiple Web3 and crypto company data breaches] (Jun 26)		<ref name="siliconrepublic-8176">[https://www.siliconrepublic.com/enterprise/hubspot-data-breach-crypto-web3-bitcoin HubSpot hack leads to multiple Web3 and crypto company data breaches] (Jun 26, 2022)</ref></references>

Azoundria: Created page with "{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/swanbitcoinhubspotdatabreach.php}} Swan BitcoinSwan Bitcoin is a platform which assists users in saving money in bitcoin by allowing easy routine purchases. The company used HubSpot to assist with managing their customer relationships. HubSpot suffered a data breach and names, email addresses, and phone numbers of customers were leaked. An announcement was made and t..."

2023-01-28T16:56:27Z

Created page with "{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/swanbitcoinhubspotdatabreach.php}} thumb|Swan BitcoinSwan Bitcoin is a platform which assists users in saving money in bitcoin by allowing easy routine purchases. The company used HubSpot to assist with managing their customer relationships. HubSpot suffered a data breach and names, email addresses, and phone numbers of customers were leaked. An announcement was made and t..."

New page

{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/swanbitcoinhubspotdatabreach.php}}

[[File:Swanbitcoin.jpg|thumb|Swan Bitcoin]]Swan Bitcoin is a platform which assists users in saving money in bitcoin by allowing easy routine purchases. The company used HubSpot to assist with managing their customer relationships. HubSpot suffered a data breach and names, email addresses, and phone numbers of customers were leaked. An announcement was made and the employee at the company who enabled the breach has been fired. Customers must be aware for future phishing scams which may target them.

This is a global/international case not involving a specific country.

== About Swan Bitcoin ==
"Our mission is to walk alongside you on your journey into Bitcoin, the future of money."

"Swan is the best way to build your Bitcoin stack, with automated Bitcoin savings plans and instant purchases. Serving clients of any size, from $10 to $10M+."

"@SwanBitcoin had data they provided to @HubSpot for marketing hacked. It includes name, email addresses, account type, phone, and in some cases company name." "Hubspot, a third-party marketing vendor, confirmed a bad actor within their company gained access to Swan client marketing data."

“While it is true that financial data is not stored in the CRM, you should be aware that data associated with the users of these companies and their behaviors is logged in the CRM,” Warren wrote. “This puts users in a unique position to be targeted in social engineering attacks.”

"But as of Tuesday, the situation looked a bit more grim, as Swan followed up with more details uncovered in its forensic investigation. It turns out that 0.2 percent of the dataset included “a limited historical snapshot of USD deposits,” the company said – an inclusion that’s “against company policy.” The company said that it’s conducted a post-mortem to ensure that the slippage won’t happen again."

"BE AWARE of oncoming potential phishing attacks. I have not seen any public statement by @coryklippsten."

"HubSpot officials told CMS Wire that “Some employees have access to HubSpot accounts,” which allows certain employees – such as account managers and support specialists – to help out customers. “In this case, a bad actor was able to compromise an employee account and make use of this access to export contact data from a small number of HubSpot accounts,” HubSpot reportedly said."

"A full list of the affected clients has not been published, but the company said it appeared to be a “targeted incident focused on customers in the cryptocurrency industry”."

"A rogue employee working at HubSpot – used by more than 135,000 (and growing) customers to manage marketing campaigns and on-board new users – has been fired over a breach that zeroed in on the company’s cryptocurrency customers, the company confirmed on Friday."

“We have terminated access for the compromised HubSpot employee account and removed the ability for other employees to take certain actions in customer accounts.” —HubSpot

This is a global/international case not involving a specific country.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

* Known history of when and how the service was started.
* What problems does the company or service claim to solve?
* What marketing materials were used by the firm or business?
* Audits performed, and excerpts that may have been included.
* Business registration documents shown (fake or legitimate).
* How were people recruited to participate?
* Public warnings and announcements prior to the event.

Don't Include:
* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
* Anything that wasn't reasonably knowable at the time of the event.
There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

== The Reality ==
This sections is included if a case involved deception or information that was unknown at the time. Examples include:

* When the service was actually started (if different than the "official story").
* Who actually ran a service and their own personal history.
* How the service was structured behind the scenes. (For example, there was no "trading bot".)
* Details of what audits reported and how vulnerabilities were missed during auditing.

== What Happened ==
The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.
{| class="wikitable"
|+Key Event Timeline - Swan Bitcoin Hubspot Data Breach
!Date
!Event
!Description
|-
|March 19th, 2022 1:13:00 PM
|Main Event
|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.
|-
|
|
|
|}

== Total Amount Lost ==
No funds were lost.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

== Immediate Reactions ==
How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

== Ultimate Outcome ==
What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

== Total Amount Recovered ==
There do not appear to have been any funds recovered in this case.

What funds were recovered? What funds were reimbursed for those affected users?

== Ongoing Developments ==
What parts of this case are still remaining to be concluded?

== Prevention Policies ==
Privacy-conscious customers can set up separate email addresses for each service easily, and avoid providing their phone number when possible. Any received emails must be viewed with scrutiny. Interact with companies only through their official websites and confirm anything with the company directly if it promises a significant reward or threatens access to your funds.

Platforms should put in place multi-signature access control on all customer data, which requires the approval of multiple people to enable the download of data.

== References ==
[https://twitter.com/stackthosesats/status/1505136787810922499 @stackthosesats Twitter] (Jun 20)

[https://threatpost.com/hubspot-data-breach-crytocurrency-industry/179086/ HubSpot Data Breach Ripples Through Crytocurrency Industry | Threatpost] (Jun 20)

[https://twitter.com/SwanBitcoin/status/1506355008127877123 @SwanBitcoin Twitter] (Jun 26)

[https://www.swanbitcoin.com/ https://www.swanbitcoin.com/] (Jun 26)

[https://twitter.com/SwanBitcoin/status/1505261139571191813 @SwanBitcoin Twitter] (Jun 26)

[https://www.hubspot.com/en-us/march-2022-security-incident Information About HubSpot's March 18, 2022 Security Incident] (Jun 26)

[https://www.siliconrepublic.com/enterprise/hubspot-data-breach-crypto-web3-bitcoin HubSpot hack leads to multiple Web3 and crypto company data breaches] (Jun 26)