Chainalysis said it discovered that a cyberattack exposed customer information, including names, usernames, password hashes and live tokens, involving all its users. It did not say whether every type of information was exposed for every user. The disclosure widened its earlier account, which had reported no evidence that attackers accessed authentication credentials or session tokens.
Chainalysis separately said an “on-path attack” exposed some customers’ passwords. It said it had contained and fixed that attack vector and was locking affected accounts and requiring password resets. The company said it still had no evidence that attackers accessed investigation data or manipulated its attribution data.
