Intuit sued over alleged cryptocurrency thefts via Mailchimp intrusion

Intuit is being sued in the US after a security failure at its Mailchimp email marketing business allegedly led to the theft of cryptocurrency from one or more digital wallets. In a proposed class-action lawsuit [PDF] filed in federal court in northern California on Friday, the plaintiff – Alan Levinson of Illinois – claimed …

[Howard Sway]

an external actor conducted a successful social engineering attack on Mailchimp employees

Should have hired more experienced staff then - cos if you pay peanuts, you get monkeys.

[David 132]

Re: an external actor conducted a successful social engineering attack on Mailchimp employees

Whenever I hear news about Mailchimp, all I can think is "what are chimps known for? Flinging poo at all & sundry. What a very appropriate name for an email marketing company..."

[ShadowSystems]

At Howard Sway, re: peanuts.

I thought that if you paid in peanuts, all you could expect was an infestation of ellef, elap, effal, pacy, those big things with the tusks & the trunk? =-Jp

I'll get my coat, it's the one with the peanut-eating critters in the pockets.

[Richocet]

Only a matter of time

My view on cryptocurrency is that it is designed for criminal activities and also that anyone holding cryptocurrency will eventually have it stolen.

Some of the characteristics of the currency such as being decentralised and untraceable, make it the most attractive target of theft ever.

So I don't think anyone who buys crypto or uses it should be protected from theft or fraud of said crypto.

[David 132]

Re: Only a matter of time

There is never a bad time to remind those who haven't heard of it of the existence of Web3IsGoingGreat.com.

[iowe_iowe]

leaving your wallet in a pub

Crypto and NFT's both fail the smell test for me. As someone who occasionally leaves my wallet on a pub table, the idea of putting serious personal wealth in something that is simultaneously so ephemeral, and planet-buggering, seems insane.

[Anonymous Coward]

I am sure NFTs have their place

but a replacement for cash ain't one of them.

Eventually, when all this settles down, I imagine they'll be vendor-specific tokens - much like gift vouchers.

[Andy E]

Pot meet Kettle

One of the main points seems to be that Mailchimp fell for a phishing attack which led to the claimants falling for a phishing attack.

I do think they have a valid point about the time taken to alert the users about the attack though.

[OhForF']

Re: Pot meet Kettle

"the plaintiff – Alan Levinson of Illinois – claimed he and potentially others fell victim to a sophisticated phishing attack".

"Defendants fell victim to one of the oldest cybertricks in the book: according to reports, one of defendants' employees fell victim to a phishing email and clicked on a malicious link," the plaintiff claimed."

It is a sophisticated phising attack if it happens to me but if anybody else falls for this old trick it is obviously gross neglicence.

[ecofeco]

Re: Pot meet Kettle

Exactly.

[Anonymous Coward]

sophisticated phishing attack/gross negligence.

I am reminded of that "tech" journalist who was scammed and rather than keep quiet about it decided to write it up from the point of view of "I'm so clever and I got scammed ..." angle.

Problem was they managed to break one of the first rules - security 101 - by giving their PIN to the scammers. But that was well hidden in the scaremongering.

[Anonymous Coward]

MalChimps Intrusion

https://youtu.be/cpe2gHG_p_c

Front 242 - Moldavia

[Doctor Syntax]

The longer the supply chain the greater the attack surface. That should be obvious to the meanest intelligence. Unfortunately Mailchimp's customers are marketing departments so they fail to clear that bar.