Cryptocurrency exchange Gemini has revealed a data breach incident resulting from a cyberattack on its Automated Clearing House (ACH) service provider, whose identity remains undisclosed.
The American crypto exchange began notifying affected individuals a month ago, on June 26, 2024 and submitted a sample of the notification letters to the Attorney General's Office in California yesterday.
According to the notification, Gemini experienced a third-party data breach when an unauthorized actor compromised its vendor's systems between June 3 and June 7, 2024. The breach affected some of Gemini's customers' banking information, including full names, bank account numbers, and routing numbers used for ACH fund transfers.
Gemini clarified that no other information, such as dates of birth, physical addresses, social security numbers, email addresses, phone numbers, usernames, or passwords, was hosted on the service provider's systems and, therefore, was not compromised.
The data breach incident has since been contained, and an investigation aided by external experts is underway. However, no additional information is available at this time.
Recipients of the notifications are advised to stay vigilant regarding incoming communications and be alert for signs of fraud utilizing the exposed information. Additionally, they are encouraged to enable multi-factor authentication on the bank accounts linked to Gemini to prevent potential hacks and contact their banks to request additional protection measures or new account numbers.
If suspicious or unauthorized activity is detected on the impacted bank accounts, it should be reported to the banks immediately.
Gemini also suggests that affected individuals consider placing fraud alerts or security freezes on their credit reports but has not offered identity theft protection services.
In a statement released after the incident, Gemini reported that 15,000 people were impacted:
"The incident at a third party involved information of approximately 15,000 Gemini customers," Gemini told BleepingComputer. "Although we notified the customers involved out of an abundance of caution, our analysis found no evidence of customer impact."
In 2022, Gemini suffered another significant data breach through a third-party vendor, exposing the contact details, including email addresses and phone numbers, of 5.7 million users. The stolen database was offered for sale on the dark web and later leaked for free on hacking forums.
