Cyber Incident Victim: HubSpot
Date:
Mar 2022
Location:
United States of America
Summary
A cybersecurity incident at CRM provider HubSpot involved unauthorized access to an employee account, enabling a targeted attack against cryptocurrency industry clients. The breach impacted fewer than 30 customer portals, with the attacker seeking contact information such as names, email addresses, and phone numbers from affected firms including Pantera Capital, Swan Bitcoin, and BlockFi. No sensitive data like government-issued IDs or passwords were compromised. The company terminated the compromised account’s access and restricted certain employee actions within customer accounts post-discovery. Impacted organizations advised vigilance against potential phishing attempts stemming from the exposed contact details.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 4 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On March 18, 2022, HubSpot, a Cambridge, Massachusetts-based customer relationship management (CRM) provider, suffered a cybersecurity incident when an unauthorized actor compromised an employee account. The breach was initially disclosed by multiple cryptocurrency services that notified their customers about a security event involving HubSpot’s systems. HubSpot confirmed the intrusion over the following weekend, characterizing the attacker as a "bad actor" who targeted specific customer data. Upon discovering the breach, the company terminated access for the compromised employee account and implemented restrictions to prevent other employees from performing certain actions within customer accounts. HubSpot’s investigation indicated the attack was deliberately focused on clients within the cryptocurrency sector, with fewer than 30 customer portals affected. The threat actor attempted to exfiltrate contact information stored in these portals but did not gain access to more sensitive categories of data.
The incident impacted several cryptocurrency firms, including Pantera Capital, Swan Bitcoin, and BlockFi, which publicly acknowledged their involvement. BlockFi confirmed it used HubSpot for CRM and marketing operations, disclosing that exposed data included customer names, email addresses, and phone numbers. The company emphasized that government-issued identification documents, financial credentials, or passwords were not stored in HubSpot and thus remained uncompromised. Affected organizations advised customers to remain vigilant for potential phishing emails or scams leveraging the stolen contact details. HubSpot’s containment measures and ongoing investigation aimed to limit further unauthorized access, though the breach drew comparisons to a 2021 Robinhood incident where social engineering similarly led to customer data exposure. No additional technical specifics regarding the attacker’s methods or the duration of access prior to detection were disclosed in initial reports.