Social engineering attacks on Mailchimp exposed customer accounts and fueled phishing

Mailchimp disclosed that attackers used social engineering against employees and contractors to steal credentials and access an internal customer support and account administration tool, leading to unauthorized access to 133 customer accounts. The company said it detected the activity on January 11, suspended affected accounts, and notified impacted customers within 24 hours. Mailchimp added that passwords and payment card data were not exposed, but the compromised account information could still be used for targeted phishing and other follow-on attacks.

The incident echoed an earlier Mailchimp breach in which intruders again manipulated employees to gain access to internal tools and target customers in the cryptocurrency and finance sectors. In that earlier case, attackers compromised 319 accounts, exported audience data from 102 accounts, accessed some customer API keys that were later disabled, and used the stolen data to send phishing emails, including messages aimed at Trezor users that impersonated breach notifications. The repeated intrusions highlighted the downstream risk posed by marketing platforms that hold customer contact data and administrative access across many organizations.