Mailchimp data breach notice

Dear community,

We are notifying you that Mailchimp, a third-party service provider used by Fantom for newsletter services, has informed us of unauthorized activity related to our account.

We are still assessing fully the nature and extent of the possible data breach, and are currently working with  Mailchimp to understand what unauthorized activity occurred, assess its extent, and further secure our account.

There appears to be an export of our audience data that occurred on 10 January, 9:57pm EST. However Mailchimp are still investigating whether the attacker actually downloaded this data.

While our investigation is still ongoing, Mailchimp have confirmed the following:

• The security exploit emanated from their side, not Fantom's . There is no evidence the incident was caused on Fantom's end.
• A Mailchimp employee fell victim to a phishing campaign.
• The attacker was trying to seek access to a tool that was used for customer service. The attacker was in Mailchimp's system for at most 24 hours. This occurred sometime on 11 January 2023.
• Mailchimp temporarily froze our account on 11 January 2023, in response to this breach.
• An unauthorized actor had access to our account and may have downloaded certain user data.
• 133 Mailchimp accounts were affected in this targeted incident.
• We have been assured that no passwords or credit card information were exposed or at risk. Similarly, no data (such as private keys, account balances, addresses, trading history) has been stored on Mailchimp.

Fantom has looked over the data was exported on 10 January, 9:57pm EST. The vast majority of user data that Fantom collects relates to email addresses,  and, for a very small number of users, first and last names. Unfortunately, for some users, according to the export mentioned above, some additional details including latitude and longitude details of where users open mailed, as well as country / region access, what was opened by which users, and at what dates and times they were opened, was also present.

The exported data includes details on both current and previous subscribers.

We will update you as to the results of our investigation. In the meantime, we strongly recommend that you continue to be vigilant for email phishing scams.

What Actions Can You Take?

If you suspect you’ve received a malicious or phishing email, do not click any links.

If the phishing email appears to be from Fantom, we strongly recommend reporting it to us by forwarding the message to privacy@fantom.foundation.

We take your privacy seriously and will do all we can to protect it.