FanDuel says Mailchimp data breach compromised its users' names and email addresses

Popular sports betting site FanDuel has informed several users that hackers stole their names and email addresses when they targeted email marketing giant MailChimp earlier this month.

Earlier this month, email marketing giant MailChimp said that on January 11, it identified an unauthorised threat actor accessing its internal tools used for customer support and account administration. 

 

MailChimp immediately launched an investigation and concluded that threat actors “conducted a social engineering attack on Mailchimp employees and contractors, and obtained access to select Mailchimp accounts using employee credentials compromised in that attack.”

“Based on our investigation to date, this targeted incident has been limited to 133 Mailchimp accounts. There is no evidence that this compromise affected Intuit systems or customer data beyond these Mailchimp accounts,” MailChimp explained.

The email marketing company said that within 24 hours of detecting the incident, it notified the primary contacts for all affected accounts and temporarily suspended account access for Mailchimp accounts where unauthorised activity was detected.

“We sent another email to affected accounts with steps to help users reinstate access to their Mailchimp accounts safely. Since then, we’ve been working with our users directly to help them reinstate their accounts, answer questions, and provide any additional support they need,” the company added.

One of the affected customers, the popular betting site FanDuel, has started notifying its users that threat actors illegally obtained their names and email addresses when they accessed Mailchimp’s customer accounts.

In a notification sent to affected customers, the company said, “Recently, we were informed by a third-party technology vendor that sends transactional emails on behalf of its clients like FanDuel that they had experienced a security breach within their system that impacted several of their clients.

“On Sunday evening, the vendor confirmed that FanDuel customer names and email addresses were acquired by an unauthorised actor. No customer passwords, financial account information, or other personal information was acquired in this incident,” FanDuel said.

While FanDuel did not name the compromised third-party vendor in the notification sent to its users, the company confirmed to BleepingComputer that it was MailChimp.

The company has urged affected users to remain vigilant against illegal activities such as phishing attacks, update their passwords, enable multi-factor authentication (MFA) on their accounts, and not open any unauthorised links sent unless initiated by the customer.

“Remain vigilant against email "phishing" attempts claiming an issue with your FanDuel account that requires providing personal or private information to resolve the problem. FanDuel will never email customers directly and request personal information to resolve an issue,” the company added.