Australian Cryptocurrency Exchange Endangers 270,000 Accounts
Sloppiness can sometimes cost a company its reputation, especially if it causes mistakes that lead to people losing money. A recent situation involving BTC Markets, a popular Australian crypto exchange, shows just how dangerous it is to entrust your personal information to centralized providers of financial services.
Table of contents:
- BTC Markets exposes thousands of users’ names and email addresses
- When haste makes waste
BTC Markets exposes thousands of users’ names and email addresses
Anonymity and security of cryptocurrencies have always been among the main points of attraction for retail investors. Unfortunately, even the most sophisticated cryptography can’t protect digital funds, and the sensitive data associated with them, from human error.
The latest example of such dangerous negligence came from BTC Markets, an Australian cryptocurrency exchange that claims to be the largest in the country. According to numerous complaints from disgruntled users that popped up all over Reddit and Twitter, the exchange suffered a security breach that had been caused involuntarily, we presume, by one of the company’s staff. As a result, more than 270,000 names and email addresses of its customers were accidentally exposed.
To the company’s credit, if it’s even due in this situation, they didn’t try to conceal the fact that the data had been leaked and informed users about what happened via official Twitter, and offered an apology for their carelessness in handling user data. Caroline Bowler, CEO of BTC Markets, was also quick to post an apologetic Tweet and later explained that the data leakage happened because the exchange utilizes an external email system for sending updates and newsletters to the customers. On December 2, the day when the data leakage occurred, the company’s marketing department mailed out the news about the upcoming listing of USDT and the participation in the airdrop program of SPARK tokens.
When haste makes waste
The leakage happened because the member of staff who is responsible for the mail-outs thought it would be a good idea to send newsletters in batches of 1,000 emails per batch. Usually, such promotions are carried out using blind copies or by sending individual emails. However, someone was probably too hasty to let customers know of the airdrop program or whatever. In any case, he or she chose not to bother with the fact that each recipient was to see 999 real names and emails of other users. Apparently, the batch formation and sending-out had been automated, so once the process was initiated, the sender was unable to stop it even after an error had come to light.
Even though none of the sensitive financial data was revealed, knowing users’ real names and email addresses would be enough for scammers to launch a targeted phishing campaign against the exposed. The exchange, in turn, assured that the incident would be reported to the Office of the Australian Information Commissioner, an independent regulator for data protection. They also promised to carry out an internal investigation and make improvements to the data security system. In the meantime, the company contacted all user who had been affected by this data leak and recommended using two-factor authentication to enhance the security of their crypto accounts.