Technology NewsFanDuel discloses data breach caused by recent MailChimp hack

FanDuel discloses data breach caused by recent MailChimp hack


FanDuel discloses data breach caused by recent MailChimp hack

The FanDuel sportsbook and betting site is warning customers that their names and email addresses were exposed in a January 2023 MailChimp security breach, urging users to remain vigilant against phishing emails.

On January 13th, MailChimp confirmed they suffered a breach after hackers stole an employee’s credentials using a social engineering attack.

Using these credentials, the threat actors accessed an internal MailChimp customer support and administration tool to steal the “audience data” for 133 customers.

This audience data is different for each MailChimp customer but commonly contains the email addresses and names of customers, or potential customers, that are used to send marketing emails.

Last Thursday, FanDuel emailed customers to warn them that the threat actors acquired their names and email addresses during the MailChimp breach.

“Recently, we were informed by a third-party technology vendor that sends transactional emails on behalf of its clients like FanDuel that they had experienced a security breach within their system that impacted several of their clients,” reads a FanDuel ‘Notice of Third-Party Vendor Security Incident’ seen by BleepingComputer.

“On Sunday evening, the vendor confirmed that FanDuel customer names and email addresses were acquired by an unauthorized actor. No customer passwords, financial account information, or other personal information was acquired in this incident.”

FanDuel also stressed that this was not a breach of their systems or FanDuel user accounts and that the hackers did not acquire “passwords, financial account information, or other personal information” during the breach.

While the security incident notification did not name the third-party vendor that was breached, FanDuel confirmed to BleepingComputer that the third-party vendor was MailChimp.

“Remain vigilant”

FanDuel urges customers to “remain vigilant” against phishing attacks and attempted account takeovers after their data was exposed in this recent breach.

“Remain vigilant against email “phishing” attempts claiming an issue with your FanDuel account that requires providing personal or private information to resolve the problem,” warns the FanDuel security incident email.

“FanDuel will never email customers directly and request personal information to resolve an issue.”

FanDuel also warns customers to update their passwords frequently, enable multi-factor authentication (MFA) on their accounts, and not click on links in attempted password resets that a customer did not initiate.

While there is no indication that the stolen MailChimp data is being used in attacks, threat actors have abused this type of stolen data in past phishing campaigns.

In April 2022, a MailChimp breach allowed threat actors to steal the marketing email data for the Trezor hardware wallet. 

This data was then used in a phishing campaign pretending to be fake data breach notifications that pushed malicious software to steal cryptocurrency wallets.

Furthermore, FanDuel accounts are in high demand, with threat actors actively performing credential-stuffing attacks to hack customers’ accounts [123].

These accounts are sold on cybercrime marketplaces for as little as $2, depending on an account’s balance or linked payment information.

Enabling MFA on a FanDuel account using an authentication app will make it much harder for accounts to be stolen, even if a threat actor gains access to a customer’s credentials.

Many account compromises are caused by using the same credentials at FanDuel as other sites then suffer data breaches. Threat actors then use these credentials to attempt to log in to accounts at other sites.

For this reason, using a password manager and creating unique passwords at every site is vital to prevent a breach at one company from affecting you at another.


Please enter your comment!
Please enter your name here

Latest news

How to know that you have to buy a new mobile phone

Despite the fact that smartphones can perfectly last several years being functional today, there are a series of...

எந்த வயதில் மக்கள் குறைவாக தூங்குகிறார்கள்?

ஆய்வில் பங்கேற்றவர்களில் இளையவர் (வயது 19) அதிகம் தூங்குவதாகவும் ஆய்வில் கண்டறியப்பட்டுள்ளது.இருந்து ஆராய்ச்சியாளர்கள் நடத்திய புதிய ஆய்வு லண்டன் பல்கலைக்கழக கல்லூரிதி கிழக்கு ஆங்கிலியா...

MSI laptops with NVIDIA GeForce RTX 4000 graphics – report from the premiere event in Warsaw

At this year's CES in Las Vegas, NVIDIA presented the new generation of GeForce RTX 4000 mobile graphics...

New Wave of Ransomware Attacks Exploiting VMware Bug to Target ESXi Servers

Feb 04, 2023Ravie LakshmananEnterprise Security / Ransomware VMware ESXi hypervisors are the target of a new wave of attacks...

Bermuda hit by widespread internet outage amid power cut

Bermuda experienced a widespread power outage since Friday evening which impacted the island's internet and phone service availability. Deeming it...

Amazing Crockpot Meatloaf | The Recipe Critic

This website may contain affiliate links and advertising so that we can provide recipes to you. Read my...

Must read

Bermuda hit by widespread internet outage amid power cut

Bermuda experienced a widespread power outage since Friday evening...

Post-Macro World Sees Rise in Microsoft OneNote Documents Delivering Malware

Feb 03, 2023Ravie LakshmananAttack Vector / Endpoint Security In...