{
  "id": "chainalysis-customer-data",
  "url": "https://ohshit.app/incidents/chainalysis-customer-data/",
  "title": "Chainalysis confirms internal-system access exposed customer identity data",
  "level": 3,
  "level_name": "sharted",
  "date": "2026-10-30",
  "date_is_approximate": false,
  "updated": null,
  "tags": [
    "Chainalysis",
    "SaaS",
    "data breach"
  ],
  "ecosystems": [],
  "summary": "Chainalysis confirms access to customer user IDs, names, emails and organization roles. It reports no evidence of access to investigation content, authentication credentials or session tokens; organization-specific record counts remain under review.",
  "splash": "Chainalysis organizations whose provisioned users' identity data was accessed; detailed scope is pending",
  "wipe": "Enable two-factor authentication, scrutinize unexpected login or reset prompts and obtain your organization's affected-record breakdown",
  "in_the_wild": "yes",
  "source_exception": null,
  "cves": [],
  "fixed": [],
  "checklist": [
    {
      "title": "Enable two-factor authentication",
      "hint": "Ask your existing Chainalysis account manager for help if your organization has not enabled it. Check unexpected authentication or password-reset prompts through your normal sign-in route before responding."
    },
    {
      "title": "Confirm your organization's exposure",
      "hint": "Follow the direct customer updates and request the promised record breakdown. Treat unsolicited recovery or recruiting messages cautiously; verify senders through an established contact rather than links in the message."
    }
  ],
  "sources": [
    {
      "name": "Chainalysis original notice and full customer email",
      "url": "https://www.chainalysis.com/blog/security-incident-october-30/",
      "primary": true
    },
    {
      "name": "BleepingComputer report and company response",
      "url": "https://www.bleepingcomputer.com/news/security/chainalysis-discloses-data-breach-from-offensive-agentic-techniques/amp/",
      "primary": false
    }
  ],
  "headline": null,
  "one_liner": null,
  "in_the_wild_note": "Chainalysis confirms unauthorized access to systems, tools and customer identity data.",
  "mitigation": null,
  "timeline": [
    {
      "date": "Oct 30, 2026",
      "title": "Chainalysis publishes its incident notice and customer email"
    }
  ],
  "body_markdown": "The company describes offensive agentic techniques but identifies no attack framework, CVE or complete access window. Its investigation has found no indication of access to graphs, notes, cases, transaction or query results, cleartext passwords, MFA secrets or session tokens; that is an interim assessment, not proof exposure was impossible. Patching and external investigation continue. Chainalysis explicitly separates this event from Binance's theft. L3 reflects confirmed customer-data access without an established mass-leak total."
}