On Monday morning, email marketing company Mailchimp said it was the victim of a data breach after hackers compromised an internal company tool to gain access to customer accounts. As reported by CriptoFácil, hardware wallet maker Trezor was one of the companies impacted by the leak. Now, metaverse platform Decentraland has also confirmed that data from some of its customers has been leaked. More precisely, the team reported that the email addresses of subscribers to the Decentraland newsletter were accessed. In addition, some user names, IP addresses and timestamps may have been leaked. On its Twitter account, the team alerted to the receipt of emails signed by Decentraland. After all, attackers can use these emails to impersonate the Foundation and promote phishing attacks.
Attention: Our newsletter subscribers’ email addresses were leaked in a Mailchimp data breach. Please stay alert as the malicious actors may use your email address to try and message you impersonating the Decentraland Foundation. Learn more details:https://t.co/UujMMZ1HXt — Decentraland (@decentraland) April 4, 2022
“Warning: The email addresses of our newsletter subscribers were leaked in a Mailchimp data breach. Stay alert as bad actors may use your email address to try to send you a message posing as the Decentraland Foundation.”
What to do?
As the platform clarified in a statement, newsletter subscribers should not download any content directly from emails:
“The Decentraland Foundation will never attach files to an email for you to download or ask you to download anything directly from an email. If we have something for you to download, we will direct you to decentraland.org for your safety.”
Also according to the team, when clicking on a link in an email, you need to check the page URL carefully.
“Make sure the URL always ends with ‘decentraland.org’. Always check that ‘decentraland’ is spelled correctly and ends in ‘.org’ before taking any action on the web page if you were directed there by a link.”
The team also showed some examples of how phishing scams can try to trick users:
In addition to confirming that the URL is correct, Decentraland recommended that the user facilitate the verification process. To do this, simply bookmark any frequently accessed Decentraland pages.
Also in the statement, the team clarified that the leak occurred in Mailchimp, a service used to send newsletters. The platform was compromised on March 24 in an attack targeting accounts that appear to be related to the crypto economy.
“The data breach involved only one download. Criminals never had access to our real Mailchimp account and were never able to send verified emails from it. This means that if they contact you, they can try using an email similar to ‘@decentraland.org’, such as ‘@decentraland.com’, some other variation, or even ‘decentraland.org’ using encoding techniques such as ‘ghost forgery’.”
Also Read: Dog Metaverse Raises $7 Million From Ubisoft, Tezos Also Read: Digihost Miner Announces Bitcoin Dividend Payment