Stock trading platform Robinhood has disclosed a data breach after their systems were hacked and a threat actor gained access to the personal information of approximately 5 million customers.

The attack occurred on November 3rd after a threat actor called a customer support employee and used social engineering to obtain access to customer support systems.

After accessing the support systems, the threat actor was able to access customer information, including full names, email addresses, and for a limited number of people, data of birth, and zip codes.

“At this time, we understand that the unauthorized party obtained a list of email addresses for approximately five million people, and full names for a different group of approximately two million people,” disclosed a blog post published today about the security incident.

“We also believe that for a more limited number of people—approximately 310 in total—additional personal information, including name, date of birth, and zip code, was exposed, with a subset of approximately 10 customers having more extensive account details revealed.”

After learning of the attack and securing their systems, RobinHood received an extortion demand. While Robinhood has not provided any details regarding the extortion demand, it was likely a threat that the stolen data would be leaked if a Bitcoin ransom was not paid.

RobinHood says they continue to investigate the incident with the help of Mandiant, a well-known cybersecurity firm commonly used to perform incident response after attacks.

“As a Safety First company, we owe it to our customers to be transparent and act with integrity,” said Robinhood Chief Security Officer Caleb Sima. “Following a diligent review, putting the entire Robinhood community on notice of this incident now is the right thing to do.”

BleepingComputer has reached out to RobinHood and will update the story if more details become available.

This is a developing story.