The FanDuel sportsbook and betting site is warning customers that their names and email addresses were exposed in a January 2023 MailChimp security breach, urging users to remain vigilant against phishing emails. On January 13th, MailChimp confirmed they suffered a breach after hackers stole an employee’s credentials using a social engineering attack. Using these credentials, the threat actors accessed an internal MailChimp customer support and administration tool to steal the “audience data” for 133 customers. This audience data is different for each MailChimp customer but commonly contains the email addresses and names of customers, or potential customers, that are used to send marketing emails. FanDuel also stressed that this was not a breach of their systems or FanDuel user accounts and that the hackers did not acquire “passwords, financial account information, or other personal information” during the breach.
Analyst Notes
Individuals who have been compromised by this breach should change login information immediately. FanDuel allows for multi-factor authentication (MFA), which should be enabled on any active account. Phishing attacks are likely to occur after this type of information is stolen. FanDuel users that have been notified of a data breach should remain vigilant for future phishing attacks. Many account compromises are caused by using the same credentials across numerous sites. If one site is breached, threat actors then use these credentials to attempt to log in to accounts for other sites. For this reason, using a password manager and creating unique passwords at every site is vital to prevent a breach at one company from affecting accounts at another.
https://www.bleepingcomputer.com/news/security/fanduels-warns-of-data-breach-after-customer-info-stolen-in-vendor-hack/?&web_view=true
