On 26 March 2022, Mailchimp's security team found an attacker using one of its internal tools, the one customer support and account administration staff use to look after customer accounts. The attacker had got in by socially engineering Mailchimp employees and taking their credentials. With the tool, the attacker viewed 319 customer accounts, exported audience data from 102 of them and obtained API keys for an undisclosed number of customers, focusing on cryptocurrency and finance businesses. The stolen mailing lists were used for phishing: customers of the hardware wallet maker Trezor received emails urging them to install fake software. Mailchimp disabled the exposed API keys, cut off the compromised employee accounts and notified affected customers.
Key takeaways
- The entry point was people: Mailchimp says a social engineering attack on employees compromised their credentials.
- The attacker reached a powerful internal support tool, viewed 319 customer accounts and exported audience data from 102, according to Mailchimp.
- Customer API keys were also exposed. BleepingComputer explains that such keys let someone send campaigns to a customer's mailing lists without logging in to the portal; Mailchimp disabled them.
- The campaign targeted cryptocurrency and finance customers, and Trezor's users received phishing emails built from the stolen data.
- The identity lesson: internal tools that can read customer API keys turn one compromised employee into access to many customers' machine credentials.
At a glance
| Organisation | Mailchimp (Intuit); affected customers in cryptocurrency and finance, including Trezor |
|---|---|
| When | Detected 26 March 2022; phishing attempt 2 April 2022; disclosed 3 to 4 April 2022 |
| Attacker | Unattributed external actor targeting the cryptocurrency industry |
| Entry point | Social engineering of Mailchimp employees, which compromised their credentials and gave access to an internal support and account administration tool |
| Identities abused | Employee accounts; customer API keys for an undisclosed number of Mailchimp accounts |
| Impact | 319 customer accounts viewed, audience data exported from 102, customer API keys exposed and then disabled; phishing sent to at least one customer's contacts |
| Category | NHI. Incident class: confirmed NHI breach (customer API keys exposed through an internal tool) |
What happened
Mailchimp's CISO, Siobhan Smyth, said the security team "became aware of a bad actor accessing one of our internal tools used by customer-facing teams for customer support and account administration" on 26 March 2022. "The incident was propagated by a bad actor who conducted a successful social engineering attack on Mailchimp employees, resulting in employee credentials being compromised." Mailchimp terminated access for the compromised employee accounts and limited employee access to internal systems.
The support tool let the attacker look inside customer accounts. Mailchimp says 319 accounts were viewed and audience data exported from 102, and that "this was a targeted incident focused on users in industries related to cryptocurrency and finance." According to TechCrunch and BleepingComputer, the attacker also "gained access to API keys for an undisclosed number of customers," which Mailchimp then disabled. BleepingComputer notes that with such keys an attacker can create campaigns and send them to mailing lists without going through the customer portal.
The data was used quickly. On 2 April, the attacker tried to send a phishing campaign from one customer's account using information from the 26 March intrusion. Mailchimp blocked the account access, but a phishing campaign still went to that customer's contacts "through other means." Over the weekend of 2 and 3 April, owners of Trezor hardware wallets received emails claiming a data breach and asking them to reset their PINs by downloading malicious software. Trezor said the emails came from a breach at Mailchimp, which it used for newsletters.
Mailchimp published its statement on 4 April 2022 and notified the owners of all impacted accounts. It recommended two-factor authentication for customers and said it was taking "an additional set of aggressive measures" while the investigation continued.
Timeline
| Date | Event |
|---|---|
| 26 March 2022 | Mailchimp detects an attacker using an internal customer support tool with compromised employee credentials. |
| 2 April 2022 | The attacker attempts a phishing campaign from a customer's account; a campaign reaches that customer's contacts through other means. |
| 3 April 2022 | Trezor users report phishing emails; Trezor links them to a Mailchimp breach. |
| 4 April 2022 | Mailchimp publishes its statement; TechCrunch and BleepingComputer report 319 accounts viewed, 102 exported and API keys exposed. |
How it happened: the identity attack path
- Employees socially engineered. The attacker tricked Mailchimp employees and obtained their credentials.
- Internal tool access. Those credentials opened a tool used for customer support and account administration, with broad visibility into customer accounts.
- Targeted account access. The attacker viewed 319 accounts, focusing on cryptocurrency and finance customers.
- Data and key theft. Audience data was exported from 102 accounts, and customer API keys were exposed.
- Phishing from stolen lists. The mailing lists were used to send phishing emails to victims' customers, including Trezor users.
Impact
- Customers: 319 accounts viewed and audience data exported from 102, according to Mailchimp.
- Credentials: API keys for an undisclosed number of customers exposed, then disabled.
- Downstream: phishing campaigns against the contacts of affected businesses, including Trezor wallet owners targeted with malicious software.
What this means for NHI governance
The first step in this breach was human: employees were deceived. What made it serious was what the compromised accounts could reach. An internal support tool could not only view customer accounts but also expose their API keys, which are machine credentials that let software send email on a customer's behalf. Once one employee login was stolen, the attacker held keys to many customers' sending infrastructure.
Support and admin tools deserve the same scrutiny as production systems. They should show only what support staff need, never reveal customer secrets in full, and log and alert on bulk viewing or export. Customers' API keys should be scoped and easy to rotate, so a provider-side incident can be contained quickly. See our API Key Management Guide and Third-Party Access Guide.
Recommendations
- Never display customer secrets in internal tools. Support staff should be able to reset or revoke a key, not read it. See our API Key Management Guide.
- Protect support staff with phishing-resistant MFA. Social engineering of employees with broad tool access is a recurring pattern. See the MFA Guide.
- Limit and monitor bulk access. Alert when one staff account views or exports many customer accounts, especially in one sector.
- Scope and rotate API keys. Customers should use keys limited to the actions they need and rotate them after any provider incident.
- Warn customers quickly when their lists are at risk. Fast notification limits phishing against downstream contacts.
Frequently asked questions
How was Mailchimp breached in 2022?
An attacker socially engineered Mailchimp employees, took their credentials and used an internal customer support tool to view customer accounts, export mailing lists and obtain API keys.
How many Mailchimp accounts were affected?
Mailchimp said 319 accounts were viewed and audience data was exported from 102 of them. API keys for an undisclosed number of customers were exposed and then disabled.
Why were Trezor users phished?
Trezor used Mailchimp for newsletters. Its mailing list was among the data the attacker reached, and Trezor users then received fake breach notices urging them to install malicious software.
Related NHI Mgmt Group resources
Twilio Breach 2022 · Okta Support System Breach 2023 · API Key Management Guide · Account Recovery and Help Desk Security Guide · Third-Party Access Guide
How NHI Mgmt Group can help
Internal tools that can read or export customer credentials are a hidden concentration of risk. We help teams find where customer secrets are visible to staff, restrict that access and design key rotation that works at scale. See our NHI and AI agent security training.