US stock trading platform Robinhood has released details on a data breach that leaked information on millions of its customers.

A threat actor supposedly gained access to vital systems after calling in to a Robinhood customer support employee and using social engineering to gain access to data.

Hackers stole information belonging to seven million app users, including five million email addresses, the names of two million people, dates of birth and postcodes of up to 300 people.

Robinhood announced a “security incident” had occurred, but they do not believe any Social Security numbers, account numbers, or debit card information were exposed.

Additionally, there does not appear to have been any financial loss for the company’s users so far. The breach has now been contained, Robinhood said.

In a blog post yesterday, the company commented: “Late in the evening of November 3, we experienced a data security incident. An unauthorised third party obtained access to a limited amount of personal information for a portion of our customers.

“After we contained the intrusion, the unauthorised party demanded an extortion payment. We promptly informed law enforcement and are continuing to investigate the incident with the help of Mandiant, a leading outside security firm.”

Adding to the blog post, Robinhood Chief Security Officer Caleb Sima said: “As a Safety-First company, we owe it to our customers to be transparent and act with integrity.

“Following a diligent review, putting the entire Robinhood community on notice of this incident now is the right thing to do.”

Robinhood has suggested that users visit their help centre for more information, and to change password information.

Recommended

• Leader Insights | Transforming the BBC with responsible AI & ML
• Report: Female-led businesses close gender funding gap in green tech
• Intelligent Growth Solutions raises £42m in latest funding round

This is not the first time that Robinhood has been the target of a sophisticated hack on its systems. As recently as October last year the company confirmed that a “limited number” of accounts were targeted by criminals, but its services were never officially hacked.

At the time, Bloomberg reported that almost 2,000 of the company’s customers had their accounts compromised.

The attack also follows a spate or data breaches by major organisations around the world in recent months, which seem to have become more common during the coronavirus pandemic.

Last month Amazon-owned online streaming platform Twitch suffered a major data breach across the entirety of its services, leaking source code and sensitive information such as user pay-outs and streamer incomes.

According to a claim from an anonymous hacker, 128gb of data was linked to a 4chan page with the intention of disrupting the online video streaming space and boosting ‘competition’ as the online streaming community is a “disgusting toxic cesspool”.

Commenting on the Robinhood breach, Trevor Morgan, product manager at comforte AG, said that social engineering attacks like this one are an easy way for hackers to gain access: “Each one of us has been exposed (probably very recently) to social engineering tricks, whether through email appeals to click a link or launch an attachment or other forms of deceptive communication.

“Robinhood’s own organisation succumbed to this “low-tech” approach to circumventing data protection methods. All it takes is one moment of inattention or gullibility, and the threat actor carrying out social engineering techniques is one step closer to the ultimate goal.”

He continued: “We have all gotten used to working faster and pushing information out as fast as we can, but this is exactly the vulnerability that social engineering preys upon.

“Not taking the time to inspect emails, to think through a situation without haste or pressure, or to confirm a request to ensure the legitimacy of the requestor is the fatal flaw.”

Get the latest news from DIGIT direct to your inbox

Our newsletter covers the latest technology and IT news from Scotland and beyond, as well as in-depth features and exclusive interviews with leading figures and rising stars.

We’ll keep you up to date on the pivotal issues impacting the sector and let you know about key upcoming events to ensure that you don’t miss out on what’s going on across the Scottish tech community.

Click here to subscribe.