An incident happened to MetaMask users who submitted customer service tickets from August 1, 2021, to February 10, 2023.
Their email addresses got leaked due to a cybersecurity attack from a malicious party. The hackers gained access through a third party that was involved. They breached their computer servers used to process customer care requests, which would let them read MetaMask users’ customer support tickets.
Only necessary information was required to fill in the tickets, including an email address to help with the replies. In the tickets was an open box to write any text the users wanted. According to the April 14 blog post, the users might have shared their personal information, such as
“economic or financial information, name, surname, date of birth, phone number, and postal address.”
ConsenSys, the parent company of MetaMask, emphasized that they do not require personal information that can identify the users, but they have chosen to provide them anyway. The number of MetaMask users that got hacked is estimated at approximately 7,000.
Keystone, a hardware wallet provider, has warned the affected MetaMask users that they might receive more phishing emails. This trend will happen because the attacker might exploit the stolen email database to find potential victims.
🚨 A third-party service provider that provides customer support ticketing services to ConsenSys was the target of a cyber-security incident
⚠️ Be cautious of the potential increase in phishing emails moving forwardhttps://t.co/HswtDiK5EY
— Keystone | Open Source Blockchain Hardware Wallet (@KeystoneWallet) April 14, 2023
MetaMask users were victims of phishing. Phishing is a type of scam where individuals are tricked into providing personal information to hackers. This kind of scam is usually achieved through emails, where hackers pretend to be someone you can trust or know.
At the end of 2022, privacy advocates criticized MetaMask because it was found that sometimes they disclose users’ IP addresses. Hence, in March 2023, it changed its terms to allow users more control over who can access this information.
