Robinhood Announces Data Breach Involving 5 Million People

The US-based online broker Robinhood confirmed yesterday that late in the evening of November 3, it experienced a data security incident. Specifically, an unauthorized third party obtained access to a limited amount of personal information for a portion of the broker's customers.

According to the announcement, based on Robinhood's investigation, the attack has been contained. No Social Security numbers, bank account numbers, or debit card numbers were exposed and there has been no financial loss to any customers as a result of the incident. 

The unauthorized party socially engineered a customer support employee by phone and obtained access to certain customer support systems.

"At this time, we understand that the unauthorized party obtained a list of email addresses for approximately five million people, and full names for a different group of approximately two million people. We also believe that for a more limited number of people—approximately 310 in total—additional personal information, including name, date of birth, and zip code, was exposed, with a subset of approximately 10 customers having more extensive account details revealed," said the broker.

Robinhood is now in the process of making appropriate disclosures to affected people.

After the broker contained the intrusion, the unauthorized party demanded an extortion payment. Robinhood promptly informed law enforcement and, it is continuing to investigate the incident with the help of Mandiant, a leading outside security firm.