Gemini data breach: 5.3M accounts exposed
Severity: medium · Patch status: no-fix-needed · Since 2022-12-16
In late 2022, a hacker posted a data set to a public hacking forum which they alleged was sourced from the Gemini crypto exchange, a claim that was later proven to be false as the data was traced back to an incident at a third-party vendor. The source of the breach was later established as being Twilio, who processed the data of some Gemini customers using their Authy service for 2FA. Twilio described the incident as stemming from a sophisticated social engineering attack designed to steal employee credentials. Exposed data: email addresses, partial phone numbers. The breach dates from Dec 13, 2022; Have I Been Pwned loaded it on Dec 16, 2022.
What to do
- If you had a Gemini account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
Sources
All live incidents on Threat Watch
